DE102020110034A1 - Monitoring system with multi-level inquiry verification - Google Patents

Abstract

The invention relates to a monitoring system that can be operatively coupled to a monitoring object (334, 920, 922, 924), the monitoring system having a processor (304, 904.1, 904.2, 904.3), a network interface (308) and at least one sensor (331, 916) and / or a control unit (333, 344, 432). The monitoring system is designed to: • receive (804) a request (322) from a request unit (328); • carry out a first check (806) of the request; • if the first check shows that the request is not trustworthy, abort (808 ) the first check without returning a response of any form to the request unit; • otherwise carrying out (810) a further check of the request; Monitoring object detected by the sensor to the request unit and / or changing the state of the monitoring object by means of the control unit in accordance with the request.

Description

Technical area

The present representations relate to microcontroller-based and microprocessor-based monitoring systems and in particular the access control to their functionality by external systems.

State of the art

Microcontroller-based and microprocessor-based systems are already widely used today to monitor a wide variety of technical objects ("monitoring objects").

Well-known examples of this are washing machines, vacuum cleaners and various other household and garden tools. Many vehicle components also have their own controls in order to be able to react semi-autonomously, e.g. the ABS and ESP system. The ABS system prevents the wheels from locking on the basis of a drop in the speed of a wheel that is considered dangerous, which can, for example, be caused by the fact that a wheel is on a surface with a lower coefficient of static friction. The ESP system prevents undesired turning of the vehicle on the basis of various sensors, e.g. a steering angle sensor. Some ESP monitoring systems compare a current angular speed around the vertical axis of the vehicle with a maximum TARGET angular speed. Although the computing capacity of microcontroller-based and microprocessor-based systems is often quite low, this is usually not a problem, since the entire chip architecture, including the peripheral functionalities that may be on it, are closely coordinated and the microcontroller or microprocessor often only a few or only one has to perform the only function that it is often optimized to perform.

In all of the above-mentioned systems there is no risk of an attack via the Internet, because the said systems do not have a corresponding network interface.

However, with the advent of autonomous or semi-autonomous driving, smart home applications and various applications and systems of the “Internet of Things” (loT), the situation has changed. Many systems for monitoring other objects absolutely require networking with the cloud or with other IoT end nodes via the Internet in order to be able to perform their function correctly. However, this makes these systems vulnerable to attacks via the network.

A particular form of attack, the Denial of Service (DoS) attack, has proven to be particularly problematic. A DoS attack is understood to mean an attack on a processing unit by means of a large number of requests within a short time window, the aim of which is the unavailability of the processing unit due to overloading of the data network or the CPUs of the processing unit. In the case of a willful blockade of a system caused by a large number of targeted requests, one speaks of a denial-of-service attack and, if the requests are carried out from a large number of computers, of a distributed denial-of-service attack (DDoS attack, German literally distributed denial of service attack). Since the requests for a DDoS attack come from a large number of sources, it is not possible to block the attacker without completely cutting off communication with the network.

DoS attacks are technically relatively simple, as their aim is not to penetrate the IoT device, but to paralyze it. Protection against such attacks is also particularly difficult for Internet-enabled IoT devices, since disconnecting the network connection often amounts to a functional failure of the IoT end node. In addition, due to their low computing capacity, IoT end nodes are particularly vulnerable to DoS attacks.

In the context of standard desktop computers and server computers, various technologies are known to protect these systems from unauthorized access by third parties via the Internet. These include e.g. firewalls, virus scanners, complex cryptographic authentication procedures and others. However, these technologies are generally not applicable in the context of IoT end nodes and similar systems, as the computing power of microcontroller-based and microprocessor-based systems is too weak for these protective mechanisms.

In addition, IoT end nodes are usually battery-operated, so that conventional, computationally intensive backup procedures would lead to the battery being discharged quickly.

Technical problem and basic solutions

Against this background, there is a need for improved microcontroller-based and / or microprocessor-based systems and methods for monitoring physical objects to the extent that the disadvantages mentioned above can thus be at least partially avoided.

In contrast, the invention is based on the object of creating an improved monitoring system for physical objects, as well as a corresponding monitoring method.

The objects on which the invention is based are each achieved with the features of the independent patent claims. Embodiments of the invention are given in the dependent claims. The embodiments listed below can be freely combined with one another, provided they are not mutually exclusive.

• - zumindest einen Prozessor;
• - eine Netzwerkschnittstelle;
• - zumindest einen Sensor, der dazu ausgebildet ist, einen aktuellen Zustand des Überwachungsobjektes zu erfassen; und/oder eine Steuereinheit, die dazu ausgebildet ist, den Zustand des Überwachungsobjektes zu verändern.

In one aspect, the invention relates to a monitoring system. The monitoring system is designed as a microcontroller-based or microprocessor-based data processing system which can be operatively coupled to a monitoring object. The monitoring system includes:

• - at least one processor;
• - a network interface;
• - At least one sensor which is designed to detect a current state of the monitored object; and / or a control unit which is designed to change the state of the monitored object.

• - Empfang einer Anfrage über die Netzwerkschnittstelle von einer Anfrageeinheit;
• - Durchführen einer ersten Prüfung der Anfrage durch den Prozessor;
• - Falls die erste Prüfung ergibt, dass die Anfrage nicht vertrauenswürdig ist, Abbruch der ersten Prüfung, ohne eine Antwort irgendeiner Form an die Anfrageeinheit zurückzugeben;
• - nur falls die erste Prüfung ergibt, dass die Anfrageeinheit vertrauenswürdig ist, Durchführen einer weiteren Prüfung der Anfrage durch den Prozessor;
• - nur falls die weitere Prüfung der Anfrage ergibt, dass die Anfrageeinheit hinreichend berechtigt ist, Ermöglichung der Übertragung von Zustandsdaten des Überwachungsobjekts, die von dem zumindest einen Sensor erfasst wurden, an die Anfrageeinheit und/oder Ändern des Zustands des Überwachungsobjekts mittels der Steuerungseinheit gemäß der Anfrage.

The monitoring system is designed to:

• - Receipt of a request via the network interface from a request unit;
• - Carrying out a first check of the request by the processor;
• If the first test shows that the request is not trustworthy, the first test is aborted without returning a response of any form to the request unit;
• - only if the first check shows that the query unit is trustworthy, carrying out a further check of the query by the processor;
• - only if the further examination of the request shows that the request unit is sufficiently authorized, enabling the transmission of status data of the monitoring object, which were recorded by the at least one sensor, to the request unit and / or changing the status of the monitoring object by means of the control unit according to the Inquiry.

Embodiments of the invention can have the advantage that carrying out a multi-stage check of the request can relieve the monitoring system considerably. The entirety of the checks to be carried out in the respective application context, including the further check, is only carried out if a first “preliminary check” of the request was positive, i.e. if the request contained at least one quickly verifiable document or an indication of its trustworthiness. Even a poorly performing microprocessor can be enabled to carry out complex test algorithms without this processor becoming vulnerable to DoS attacks, because a DoS attack would already fail in the first test step and the further and possibly computationally expensive test steps would no longer be carried out at all .

Embodiments of the invention can also have the advantage that if the first test is negative, the monitoring system does not return a response, not even an error message. This can prevent a potential attacker from being able to draw conclusions about the test system or the query test and authentication method used by it based on the error message. A response would at least tell the attacker that a monitoring system can actually be reached at the address used by the attacker. Because the surveillance system does not return any response, the attacker is left in the dark as to whether his attack actually hit an existing surveillance system. This can increase the security for embodiments of the invention, because the attacker is deprived of the motivation and the possibility to deal more closely with a response from the monitoring system and to adapt the next attack accordingly.

According to embodiments of the invention, the monitoring system disconnects the network connection to the query unit if the first check shows that the query that the query is not trustworthy. The network connection between the monitoring system and the query unit can exist, for example, at a higher level of the OSI model, in particular the application level.

Embodiments can have the advantage that the disconnection ensures that, at least initially, no further inquiries can be sent by the inquiry unit which could possibly contain malicious code. First a network connection, for example an SSH connection or a connection according to another data exchange protocol, has to be re-established. For example, the monitoring system can be configured in such a way that it allows a data transmission connection to be re-established to the same request unit only after a minimum time interval to the last failed (considered untrustworthy) request, e.g. 5 minutes or an hour. Thus can Embodiments of the invention ensure that the processor of the monitoring system is not blocked by repeated closing and re-establishment of a data exchange connection to the query unit.

For example, the monitoring system can be connected to other monitoring systems and / or the query unit via a network connection. The network connection can be designed as a radio connection, for example. Additionally or alternatively, the network connection can also be established via e.g. Bluetooth Low Energy (BLE) and WiFi.

According to embodiments, the further test is computationally more complex than the further test.

According to one embodiment, the first test consists of one or more arithmetic operations on numeric data values. In particular, the first check can consist of a check as to whether the request contains a credential in the form of a numerical data value that is identical to a reference credential stored in a non-volatile storage medium of the monitoring unit.

According to one embodiment, the request and / or the request unit is not considered to be trustworthy if it is recognized in the course of the first check that the request does not contain the numerical authorization.

Embodiments of the invention can have the advantage that the first test can be carried out in a very resource-saving manner. The reference credential is a numeric value. A check for the identity of two values can be carried out by processors and especially microprocessors in a highly efficient, resource-saving manner. Thus, by comparing a value received with the request with some reference credentials stored in the monitoring system, the monitoring system can already identify attackers and a large number of other unauthorized systems, because the reference credentials are not known to them. Even a poorly performing microprocessor can carry out several of these numerical value comparisons in a short time.

Additionally or alternatively, the further test includes a certificate chain test. The certificate chain check includes a check as to whether a user certificate representing the query unit can be derived from a root user certificate that is considered to be trustworthy via a chain of further user certificates.

Embodiments of the invention can have the advantage that the certificate chain check can reliably prove the identity or a property, e.g. a right, of a specific user or of a monitoring system represented as a user. For example, the root certificate can come from an official certification authority, so that the certificate chain check can be used to check whether the identity or the property is derived directly or indirectly from this root certificate, which is considered to be trustworthy. Carrying out a certificate chain check is often computationally expensive, but since this is only carried out during the further check, the probability is very high that the request does not come from an attacker, but from a computer or other monitoring system that has the necessary rights, whereby this is ultimately only decided by the further examination.

Embodiments can have the advantage that the further check is only carried out if the first check revealed that the authorization verification of the display is known to the monitoring system and is stored in the monitoring system in the form of an identical reference authorization verification. This saves the computing capacity of the monitoring system. While the first check only included one or more comparisons of numerical values for identity, the subsequent check can be more complex and therefore comparatively computationally intensive. However, since the further check is only carried out if the first check was already positive, this effort is only incurred for inquiries from query units that are with some probability also sufficiently authorized to have the desired function carried out by the monitoring system. Thus, a good compromise can be found between the desire for a low computing load on the one hand and the desire to carry out complex and correspondingly secure authentication processes.

• - Ein Infrastrukturobjekt, insbesondere ein Infrastruktur-Gebäude (z.B. ein Krankenhaus, ein städtisches oder kommunales Gebäude, ein Bibliotheksgebäude), eine Energieerzeugungsanlage, ein Elektrizitätswerk, eine Anlage eines Wasserwerks, ein Kraftwerk;
• - eine militärische Anlage;
• - eine industrielle Anlage zur Produktion von Gütern;
• - eine Vorrichtung, z.B. eine Tür oder ein Tor,
• - eine Maschine, z. B. ein Gerät der Medizintechnik, ein Haushaltsgerät wie z.B. eine Waschmaschine, ein Fernsehgerät, einen Router, ein Mobiltelefon oder allgemein ein Gerät der Unterhaltungselektronik;
• - ein Fahrzeug;
• - ein Flugzeug;
• - eine Komponente der vorgenannten Objekte;
• - eine Kombination aus zwei oder mehr der vorgenannten Objekte.

According to embodiments of the invention, the surveillance object is selected from a group comprising:

• - An infrastructure object, in particular an infrastructure building (for example a hospital, a city or municipal building, a library building), an energy generation plant, an electricity plant, a water plant plant, a power plant;
• - a military installation;
• - an industrial plant for the production of goods;
• - a device, e.g. a door or a gate,
• - a machine, e.g. B. a device of medical technology, a household device such as a washing machine, a television set, a router, a mobile phone or a general consumer electronics device;
• - a vehicle;
• - an airplane;
• - a component of the aforementioned objects;
• - a combination of two or more of the aforementioned objects.

• - Leistungsparameter des Überwachungsobjekts, insbesondere Drehzahl, Energieverbrauch, Wirkungsgrad, Beschleunigung, Größenveränderung, Temperatur, Menge der verbrauchten Verbrauchsmittel, Menge der erzeugten oder bereitgestellten Güter, zurückgelegte Strecke, Temperatur;
• - Verschleißparameter, die einen Verschleiß des Überwachungsobjekts oder seiner Komponenten anzeigen, insbesondere Schwingungsmessdaten, optische oder leitfähigkeitsbasierte Rostindikatoren, Menge der verarbeiteten oder bereitgestellten Güter, akkumulierte Betriebsdauer, zurückgelegte Strecke;
• - Zustandsindikatoren, die einen aktuellen Zustand des Überwachungsobjekts angeben, insbesondere „inaktiv“, „bereit“, „aktiv“, „defekt“, „Grad der Aktivität in %“;
• - eine Kombination aus zwei oder mehr der vorgenannten Zustandsparameter.

According to embodiments of the invention, the status data of the monitored object detected by the at least one sensor is selected from a group comprising:

• - Performance parameters of the monitored object, in particular speed, energy consumption, efficiency, acceleration, change in size, temperature, amount of consumables used, amount of goods produced or provided, distance covered, temperature;
• Wear parameters that indicate wear of the monitored object or its components, in particular vibration measurement data, optical or conductivity-based rust indicators, quantity of goods processed or provided, accumulated operating time, distance covered;
• - Status indicators which indicate a current status of the monitored object, in particular “inactive”, “ready”, “active”, “defective”, “degree of activity in%”;
• - a combination of two or more of the aforementioned state parameters.

• - eine Aktivierung des Überwachungsobjekts;
• - eine Deaktivierung des Überwachungsobjekts;
• - eine Erhöhung der Leistung des Überwachungsobjekts;
• - eine Reduzierung der Leistung des Überwachungsobjekts.

According to embodiments of the invention, the change in state of the monitoring object brought about by the control unit is selected from a group comprising.

• - an activation of the monitoring object;
• - a deactivation of the surveillance object;
• - an increase in the performance of the monitored object;
• - a reduction in the performance of the monitored object.

According to embodiments of the invention, the monitoring system is an embedded system.

An embedded system (also English embedded system) is an electronic computer that is integrated (embedded) in a technical context, wherein the computer either takes over monitoring, control or regulation functions with regard to the monitoring object and / or for a form of data or Signal processing of sensed status data of the monitored object is responsible. This data or signal processing can be, for example, the encryption or decryption, coding or decoding or filtering of data, in particular measurement data.

Embedded systems are often specially adapted to a task. For reasons of cost, an optimized, mixed hardware-software implementation is chosen. Such a construction combines the great flexibility of software with the performance of the hardware. The software is used to control the system itself and to interact with the outside world via defined interfaces or protocols (e.g. LIN bus, CAN bus, ZigBee for wireless communication or IP over Ethernet).

According to embodiments, a large number of otherwise autonomous monitoring systems are functionally networked with one another in order to provide a complex overall system (e.g. in vehicles or aircraft and in loT applications).

According to embodiments, the monitoring system further comprises a software or hardware-based functionality.

A software-based functionality can be implemented, for example, in instructions ("software") that can be executed by the processor.

The functionality can be used to monitor the monitored object and include, for example, a control of the sensor for sensing and / or storing the sensed status data. Additionally or alternatively, the functionality can include a control of the control unit, the control including causing the control unit to generate a control command and to send it to the monitoring object, the control command leading to a change in the state of the monitoring object. For example, the monitored object can be a turbine or a motor and the functionality can consist of a control unit that sends a control command to the monitored object, e.g. to increase or reduce its speed.

The monitoring system is configured to carry out the functionality only if the first and further tests are positive, that is to say, for example, have the result that the request and the request unit are trustworthy. When executing, information is preferably given within the request is taken into account. For example, the request can include increasing the number of revolutions of a turbine to a certain absolute value or by a certain value relative to the current number of revolutions. The execution of the functionality would then include causing the control unit to generate a control command which specifies the reduction in the number of revolutions by the said value and to send the control command to the turbine (monitoring object). The control command causes the turbine to reduce its number of revolutions accordingly.

According to another example, the software-based functionality can include that the query unit receives data from the monitoring system, e.g. sensor data that one or more sensors of the monitoring system have detected and stored locally.

According to another example, the software-based functionality can include that the query unit receives or is allowed to actively read out a trained ML model that has been trained on locally recorded data of the monitoring system, or a prediction that has been calculated by a prediction software of the monitoring system.

According to a further example, the software-based functionality includes the storage of data in a local data memory of the monitoring system. The data to be stored can be, for example, measurement data that the at least one sensor of the monitoring system has recorded with regard to the status of the monitored object over a certain period of time. Alternatively, the data to be stored can be data that is contained in the request. For example, the data contained in the query can be a trained ML model of another monitoring system or the query unit, the query serving, for example, to synchronize several ML models between the monitoring systems and / or the query unit.

A hardware-based functionality can be, for example, a switch that is actuated manually and / or at the instigation of the monitoring system and the actuation of which initializes the acquisition of sensor data by the at least one sensor of the monitoring system. Additionally or alternatively, actuation of this switch can cause a change in the state of a larger mechanically movable component of the monitored object via the control unit, e.g. opening a gate, closing a locking system, etc.

According to embodiments of the invention, the monitoring system is configured to return results of the execution of the functionality to the query unit.

For example, measured values recorded by a sensor of the monitoring system, predictions calculated by software of the monitoring system, results of a control command for opening or closing doors or gates can be returned to the query unit.

According to embodiments, the storage medium of the monitoring system contains a user data database. The user data database contains several data records. In some embodiments, the storage medium can also contain a plurality of such user data databases. At least one of the data sets contains status data of the monitored object that was recorded by the at least one sensor. Additionally or alternatively, at least one of the data records contains configuration data that are read by the control unit when the state of the monitoring object changes and are taken into account when the state changes. For example, the monitored object can contain a door and contain the request to open this door. A default value can be stored in the configuration data, which indicates how far, i.e. up to which opening angle, the door is to be opened, provided no other value is specified in the request or the value specified in the request is outside of one in the configuration data stored permissible value range.

According to embodiments, the storage medium of the monitoring system further comprises an ID database. A large number of user certificates and a large number of access certificates are stored in the ID database.

A user certificate is a data value that is uniquely assigned to a user. For example, the user certificate can be a number or preferably a certificate issued by a certification authority, e.g. an X.509 certificate. A user can represent a natural person, but also a monitoring system or a query unit.

An access certificate is a numerical data value which, by assigning this access certificate to the user certificate in the ID database, grants a user a certain type of data record access to data records in the user data database.

Embodiments can be advantageous because the separation of user data and user certificates as well as associated access rights is a very important factor can enable complex, flexible and fine-grained access rights management.

For example, a specific user or his user certificate in the ID database can be assigned three different access certificates in the form of three different numerical values. The first access certificate authorizes reading of data records created by this user. The second access certificate authorizes the user to write or modify the data record created by this user. And the third access certificate allows access to an index that contains the field values of this data record.

According to embodiments, the further check comprises a check as to whether the request contains a user certificate to which one of the access certificates is assigned in the ID database, which authorizes the request unit to receive the status data and / or to initiate a change in the status of the monitoring object. The monitoring system is configured to enable the transmission of the status data and / or the changing of the status of the monitoring object only if the request contains such a user certificate.

For example, this user certificate can be a user certificate which authorizes the query unit to initiate the execution of the hardware or software functionality described above. The monitoring system is configured to only initiate the execution of this functionality if the request contains such a user certificate.

Embodiments can be advantageous since the use of different access certificates for different forms of access can enable extremely fine-grained access management. For example, the monitoring system can differentiate between three different types of access rights, each of which can be designed as a unique numerical value. The type of access granted by the corresponding access certificate can be specified e.g. by the storage position or the field of this access certificate in the ID database and / or in metadata of the access certificates and / or by numerical prefixes or suffixes.

According to embodiments, each of the reference credentials is one of the access certificates of the ID database.

According to embodiments, the storage medium contains one or more reference credentials. The monitoring system is configured to match the reference credentials with the request, each of the reference credentials being one of the access certificates of the ID database, the access certificates each being numerical data values.

For example, all access certificates can be designed as purely numerical values. Each user can be assigned as many unique numerical values as access certificates throughout the monitoring system as there are types of access that are individually allowed or prevented. The use of numerical values has the advantage that a check as to whether an access right exists can be carried out very quickly and with little computational effort by comparing two numbers.

• - ein Lesezugriffs-Zertifikat, welches einem Nutzer einen lesenden Zugriff auf den zumindest einen Datensatz ermöglicht;
• - ein Schreibzugriffs-Zertifikat, welches einem Nutzer einen modifizierenden Zugriff auf den zumindest einen Datensatzes ermöglicht; der Schreibzugriff kann z.B. das Löschen (DELETE) oder Ändern (UPDATE) eines Datensatzes beinhalten;
• - ein Indexzugriffs-Zertifikat, welches einem Nutzer Kenntnis der Existenz des zumindest einen Datensatzes in der Nutzdaten-Datenbank und einen lesenden Zugriff auf Metadaten des zumindest einen Datensatzes ermöglicht.

According to embodiments, the access certificate is selected from a group comprising:

• - A read access certificate, which enables a user read access to the at least one data record;
• - A write access certificate, which allows a user a modifying access to the at least one data record; the write access can include, for example, the deletion (DELETE) or modification (UPDATE) of a data record;
• an index access certificate which enables a user to know the existence of the at least one data record in the user data database and read access to metadata of the at least one data record.

For example, an index access certificate enables a user or a requesting system to receive a statistical evaluation of several data records, for example with regard to the question of how many data records in a user data database a particular user has read or write access to or how many data records in the user data field Contain the words "calibration error".

A “user” here can also refer to a person, however, a further monitoring system and / or the query unit, since such a monitoring system can be viewed as a “virtual user”.

The use of several different types of access certificates for different types of access and the individual assignment of these certificate types to individual users in order to enable them to access the data created by a user can be advantageous, as this enables particularly fine-grained control of access to the data is made possible.

According to embodiments, the request contains a user certificate, referred to here as a request user certificate. The data records of the user database each contain the access certificate of the user who created the data record as part of the data record in a separate field of the data record.

The access certificates stored in the corresponding fields of the data record are preferably pure numerical values, not complex x509 certificates. Metadata relating to the validity and other aspects can be stored separately from the actual access certificate in the ID database. Each data record created by a specific user in a user data database preferably contains all access certificates of the user creating this data record in its corresponding fields. For example, if a data record DS is created by the user (e.g. user, local process or external monitoring system) “U1” and the user U1 has exactly 3 types of certificates (a read access certificate “U1.Z-Cert [R] ", a write access certificate" U1.Z-Zert [W] "and an index access certificate" U1.Z-Zert [S] "), copies of exactly these 3 access certificates are made when the Data record DS is created from the ID database and saved in the corresponding fields of the data record DS. If the user U1 now grants another user U2 reading rights with regard to the data record DS, this means that this read access certificate “U1.Z-Zert [R]” of the user U1 and the user certificate is assigned in the ID database of the user U2 is saved. If the user (eg user, local process or external monitoring system) "U2" now wants to access the data record DS at a later point in time, the user data database containing the data record DS automatically sends an in response to the access request from user U2 Authorization request to the ID database together with the access rights of the creator U1 stored in the data record DS. The ID database then checks whether a user certificate assigned to the user U2 is stored in the ID database linked to one or more of the access rights of the creator U1 stored in the data record DS. He is only allowed to access the data record if this is the case.

In some embodiments, the ID database additionally checks whether the user U2 is additionally assigned an owner certificate for the user data database that contains the one data record in the ID database. Only if the ID database contains a user certificate assigned to the user U2, which is stored linked to one or more of the access rights of the creator U1 stored in the data record DS, and if the user U2 is also the owner of the user data database, he may access the data set.

According to embodiments, the at least one access certificate, which is preferably stored as part of the data record created, comprises a plurality of access certificates for other types of access in each case. The multiple access certificates include, for example, a write access certificate Z.Zert_U2 [W] of the creating user, and / or a read access certificate Z.Zert_U2 [R] of the creating user and / or an index access certificate Z.Zert_U2 [S ].

According to embodiments, the checking and / or management of the access authorizations, i.e. for example the generation and checking of user certificates, owner certificates, access certificates and / or corresponding chain objects, is carried out by an access management system instantiated on the monitoring system, which can be used, for example, as an access Management program can be designed, implemented.

According to embodiments of the invention, the access management system automatically generates an index structure for each of the access types from the access certificates of all data records which this access type specifies. For example, a first index for the write access certificates, a second index for the read access certificates and a third index for the index access certificates as well as a further index for the user data itself can be created. In response to a database question from a user who accesses one or more of the indices of the access certificates created for the user data database, the access management system checks whether the user has received an index access certificate (Z.Zert_U2 [S]), which a user is assigned knowledge of the existence of the data record in the user data database and read access to metadata of the data record. This check can in particular be carried out by the user data database in interoperation with the ID database and possibly other modules, for example the ID management module. The user data database enables the requesting user to use the one or more indices to execute the database request only if the requesting user has been assigned the index access certificate.

This can be advantageous because the index can be used to quickly query access authorization statistics for the data records of a database with regard to several different users. This then shows, for example, which of the users registered with the access management system is authorized to read, write and / or index access to which data records. However, via a request that is made possible by the index access certificate, only statistical information is given about several data records, read or write access to the user data of the data records is not included in the rights granted by an index access certificate.

Embodiments can have the advantage that the access certificate can be indexed separately from the other useful data, so that a quick search for data records that a specific user has created is possible via the index.

According to embodiments, a plurality of access authorization chain objects are stored in the ID database. Each access authorization chain object contains one of the access certificates and one or more of the user certificates, the order of the user certificates in the access authorization chain object reflecting the sequence of users who give this access certificate to another user, whose user certificate is in the access authorization chain object is included, have assigned. The ranking of the user certificates in the access authorization chain object indicates the sequence of granting the right specified in the access certificate based on the user represented by the first user certificate in the access authorization chain object.

The further check of the request includes a check as to whether there is an access authorization chain object in the ID database that contains an access certificate that is identical to the credentials contained in the request, this access authorization chain object this access certificate directly or the request user certificate via a chain of one or more further user certificates, this assignment proving the granting of the right specified in the access certificate to the request user represented by the request user certificate.

The further check only results if the ID database contains such an access authorization chain object that the request unit is allowed to transmit the status data and / or control the monitoring object (e.g. is authorized to initiate the execution of a corresponding hardware or software functionality of the monitoring system).

Embodiments of the invention can have the advantage that individual users or monitoring systems can be given the possibility, by means of access authorization chain objects, to delegate or delegate access rights to their own data records (recorded via the at least one own sensor) that contain status data of the currently or formerly operationally linked monitoring object to grant other users or monitoring systems in a non-delegable form.

According to embodiments, the user data database is assigned an owner certificate. The owner certificate is in turn assigned to a user certificate of a user in the ID database. An owner certificate is a certificate that is assigned to one or more user data databases and grants every user to whom it is assigned the right to create data records in this user data database.

The further check of the request includes a check as to whether the request contains a user certificate which is assigned to the owner certificate of the user data database in the ID database, the further check only being positive if this is the case Result results, so for example has the result that the query unit is sufficiently authorized.

This can be advantageous because every user or every monitoring system to which a user certificate is assigned in the ID database, also on the lowest "rights level", has full control over the data records created by him in the user data database: Even if another user, e.g. the query unit or another monitoring system, the user to whom the monitoring system is assigned, has an owner certificate for the user data database and is therefore authorized to create his own data records there, this does not mean that this user automatically has read or manipulative access to the data created by other users. This increases data protection enormously, because the user generating the data ("producer-user") can be an external system that is not completely trusted. For example, an owner certificate for a user data database can be issued to another monitoring system so that it can write data, for example trained ML models, into the user data database. The data can, for example, be contained in a request that is checked in two stages as described. However, this does not automatically mean that other monitoring systems, which also have owner rights for this user data database, can have read access to these data records. Rather, this is only possible if a user who creates a specific data record explicitly assigns one or more access rights with regard to the data records created by this user to these other monitoring systems. In an advantageous aspect, some embodiments can therefore ensure a high level of data protection, since two independent parameters are checked before access is granted (both with regard to ownership and with regard to access authorization). Thus, a complex rights management can be established, which enables a coordinated and secure data exchange between several networked monitoring systems and / or access to local storage areas of other monitoring systems. This can be particularly advantageous in application scenarios where a large number of monitoring systems autonomously monitor an operationally coupled monitoring object, but the monitoring systems nevertheless exchange information in a safe and controlled manner for specific functions, e.g. software updates, synchronization of training data or trained ML models, etc. . For example, all or a larger number of sensor-equipped monitoring systems for the various components of a vehicle or building can autonomously monitor the status of the vehicle components or building components coupled to them, but they can still exchange data with one another, e.g. the recorded sensor values or queries that make predictions, in particular contain warnings or ML models. The monitoring units of the vehicle or the building thus form a “monitoring network” or distributed monitoring system consisting of semi-autonomous monitoring units. This can greatly improve functionality. If, for example, the cooling water monitoring system calculates a prediction based on the locally recorded measured values that the engine will reach a critical temperature in 10 minutes with a consistently rapid temperature rise and throttle the power, the engine monitoring system can act as a query unit and send a query with this message and send proof of authorization for writing a specific, “warning-related” data record in the respective local user data databases to all addresses of further monitoring systems of the vehicle stored in the engine monitoring system. After carrying out the multi-stage check of this warning request, they can save the warning locally and then decide autonomously whether and how to react to this warning message.

In a further aspect, embodiments of the invention can ensure that technical administrators who, for example, provide and administer the monitoring system, do not have any special access rights with regard to the access rights to the information stored in the user data databases.

According to embodiments, the user data database of the monitoring system is free of access authorization chain objects. In addition to the user data, the data records in the user data database only contain the access certificates that grant the user who created this data record access to this data record.

According to embodiments, the ID database is designed to generate authorization tokens for an inquiring user (e.g. for an inquiring monitoring system to which a user certificate is assigned) upon request. The user data database is designed to check the authorization on the basis of the authorization token.

Embodiments can have the advantage that the separation of user data storage in one database and the storage of access and user certificates in another database in combination with the issuing and checking of authorization tokens in the interaction of the two databases enables very fine-grained access control. The associated arithmetic operations are only carried out in the course of the further authorization check, i.e. only if the initial check has ended with a positive result (the query is trustworthy). In addition, embodiments can have the advantage that it is possible to export user data to other monitoring systems without the entire access rights management used in a specific monitoring system, which is essentially stored in the ID database, is also transferred to the other monitoring system, so that here each Monitoring system can continue to maintain its own rights management.

• - Ermitteln der Zugriffs-Zertifikate des Ersteller-Nutzers (also eines Nutzers oder Überwachungssystems, welches diesen Datensatz initial erzeugt und in der Nutzdaten-Datenbank gespeichert hat), die in der Nutzdaten-Datenbank als Bestandteil des einen Datensatzes gespeichert sind, durch die Nutzdaten-Datenbank;
• - Senden des Anfrage-Nutzer-Zertifikats, das dem Nutzer der Anfrageeinheit zugeordnet ist, und der ermittelten Zugriffs-Zertifikate, an die ID-Datenbank;
• - In Antwort auf den Empfang des Anfrage-Nutzer-Zertifikats und der ermittelten Zugriffs-Zertifikate, Generierung eines Berechtigungstokens durch die ID-Datenbank, wobei der Berechtigungstoken angibt, ob der Anfrage-Nutzer dem einen Datensatz durch zumindest eines der Zugriffsermächtigungskettenobjekte zugewiesen ist;
• - Übermittlung des Berechtigungstokens von der ID-Datenbank an die Nutzdaten-Datenbank;
• - Prüfung, durch die Nutzdaten-Datenbank, anhand des Berechtigungstoken, ob dem Anfrage-Nutzer ob dem Anfrage-Nutzer die erforderlichen Zugriffsrechte in Form von Zugriffs-Zertifikate in Bezug auf den einen Datensatz zugewiesen sind;

According to embodiments, the request includes an access request from a request user (request unit, e.g. further monitoring system for the same or a different monitoring object or a user to which this request unit is assigned) to a data record that a creator user has created in the user data database . The monitoring system is configured to:

• - Determination of the access certificates of the creator-user (i.e. a user or monitoring system that initially generated this data record and stored it in the user data database), which are stored in the user data database as part of the one data record, by the user data Database;
• - Sending the request user certificate, which is assigned to the user of the request unit, and the determined access certificates, to the ID database;
• - In response to the receipt of the request user certificate and the determined access certificates, generation of an authorization token by the ID database, the authorization token indicating whether the request user is assigned to the one data record by at least one of the access authorization chain objects;
• - Transmission of the authorization token from the ID database to the user data database;
• - Check, by the user data database, on the basis of the authorization token, whether the request user whether the request user has been assigned the necessary access rights in the form of access certificates with respect to the one data record;

The user data database is configured to grant the request user access to the one data record only to the extent of the access certificates which are assigned to the request user in the authorization token.

• - Ermitteln der Zugriffs-Zertifikate des Ersteller-Nutzers (also eines Nutzers bzw. Überwachungssystems, welches diesen Datensatz initial erzeugt und in der Nutzdaten-Datenbank gespeichert hat), die in der Nutzdaten-Datenbank als Bestandteil des einen Datensatzes gespeichert sind, durch die Nutzdaten-Datenbank;
• - Senden des Anfrage-Nutzer-Zertifikats, das die Anfrageeinheit repräsentiert, und der ermittelten Zugriffs-Zertifikate, an die ID-Datenbank;
• - In Antwort auf den Empfang des Anfrage-Nutzer-Zertifikats und der ermittelten Zugriffs-Zertifikate, Generierung eines Berechtigungstoken durch die ID-Datenbank, wobei der Berechtigungstoken angibt, ob der Anfrage-Nutzer einem Eigner-Zertifikat der Nutzdaten-Datenbank durch zumindest eines der Eignerschaftsermächtigungskettenobjekte zugewiesen ist und ob der Anfrage-Nutzer dem einen Datensatz durch zumindest eines der Zugriffsermächtigungskettenobjekte zugewiesen ist;
• - Übermittlung des Berechtigungstoken von der ID-Datenbank an die Nutzdaten-Datenbank;
• - Prüfung, durch die Nutzdaten-Datenbank, anhand des Berechtigungstoken, ob dem Anfrage-Nutzer ein Eigner-Zertifikat für die Nutzdaten-Datenbank zugewiesen ist und ob dem Anfrage-Nutzer die erforderlichen Zugriffsrechte in Form von Zugriffs-Zertifikate in Bezug auf den einen Datensatz zugewiesen sind;

According to some embodiments, the presence of an owner certificate is also included in the check. For example, the request includes an access request from a request user, who represents the request unit, to a data record that a creator-user has created in the user data database. The monitoring system is configured to:

• - Determination of the access certificates of the creator-user (i.e. of a user or monitoring system that initially generated this data record and stored it in the user data database), which are stored in the user data database as part of the one data record, by means of the user data -Database;
• - Sending the request user certificate, which represents the request unit, and the determined access certificates, to the ID database;
• - In response to the receipt of the request user certificate and the determined access certificates, generation of an authorization token by the ID database, the authorization token indicating whether the request user has an owner certificate of the user data database by at least one of the Ownership authorization chain objects are assigned and whether the request user is assigned to the one data record by at least one of the access authorization chain objects;
• - Transmission of the authorization token from the ID database to the user data database;
• - Check, by the user data database, on the basis of the authorization token, whether the request user has been assigned an owner certificate for the user data database and whether the request user has the necessary access rights in the form of access certificates with regard to the one data record are assigned;

The user data database is configured to allow the request user to set up a database connection to the user data database only if the user has been assigned an owner certificate for the user data database and the request user only has access to the one data record to the extent that it is granted by the access certificates in the authorization token.

This can be advantageous because a user who does not have an owner certificate is prevented from establishing a connection to the user data database from the outset. This makes it possible to ensure globally in a simple manner (e.g. by withdrawing the owner certificate) that a specific user (or specific monitoring system or query unit represented by this user) can no longer access any data from a specific user data database without that for this purpose a large number of users or monitoring systems, who have granted this user or monitoring system access rights for the data records they have created, would have to withdraw the access rights from this one user individually. Through assignment or withdrawal (e.g. invalidation or refusal to reissue after the expiry of a current owner certificate (typical period of validity e.g. within a few days, weeks or months)), a relatively far-reaching, globally easily controllable access protection for all data stored in a database to be provided. If, for example, a certain monitoring system collects measured values in its user data database that have been recorded by several other monitoring systems for different monitoring objects, and if it is recognized that one of these monitoring systems is supplying incorrect measurement data due to a calibration error of its sensor, this one monitoring system can simply assign the ownership Certificate for the user database are withdrawn in order to protect the user data database from being loaded with incorrect data. This can be particularly advantageous if this data forms the database for predictions or is used to train ML models (machine learning models).

For example, the request can be a request to predict and return a future technical parameter value - for example on the basis of the data records stored in the user data database. The data set to which access is requested can be, for example, a machine learning model that has learned in a training process on local training data, a future value of a certain parameter (e.g. a status and / or performance parameter of the monitoring object) to predict. For example, the parameter value to be predicted could be the probable point in time when a specific component that functions as a monitoring object, based on Material fatigue must be replaced, the parameter values on the basis of which this prediction is calculated, are current vibration parameter values that are recorded by sensors of the monitoring system that is operatively coupled to this component.

• - ein Nutzer, dem ein Eigner-Zertifikat für die Nutzdaten-Datenbank zugeordnet ist und welcher ein Eigner-Zertifikat für einen anderen Nutzer für diese Nutzdaten-Datenbank erstellt, den Delegierbarkeitsparameter des erstellten Eigner-Zertifikats unabhängig vom Delegierbarkeitsparameter des ihm zugeordneten Eigner-Zertifikats auf „NICHT DELEGIERBAR“ setzen kann, den Delegierbarkeitsparameter des erstellten Eigner-Zertifikats jedoch nur dann auf „DELEGIERBAR“ setzen kann, wenn der Delegierbarkeitsparameter seines Eigner-Zertifikats den Wert „DELEGIERBAR“ hat; und
• - ein Nutzer, welchem eine Eigner-Zertifikat für eine Nutzdaten-Datenbank zugeordnet ist, dessen Delegierbarkeitsparameter den Wert „NICHT DELEGIERBAR“ hat, keine weiteren Eigner-Zertifikate für andere Nutzer für diese Nutzdaten-Datenbank erstellen kann.

According to embodiments, each of the owner certificates contains a delegability parameter which can either assume the data value “DELEGATABLE” or the data value “NOT DELEGATABLE”. A program logic used to create the owner certificates, for example an ID management module, is configured in such a way that

• - a user who is assigned an owner certificate for the user data database and who creates an owner certificate for another user for this user data database, the delegation parameter of the owner certificate created independently of the delegation parameter of the owner certificate assigned to him Can set "NOT DELEGATABLE", but can only set the delegatability parameter of the created owner certificate to "DELEGATABLE" if the delegatability parameter of its owner certificate has the value "DELEGATABLE"; and
• - a user who is assigned an owner certificate for a user data database whose delegation parameter has the value “NOT DELEGATABLE” cannot create any further owner certificates for other users for this user data database.

According to alternative embodiments, a data object which assigns an owner certificate to a specific user or which assigns the owner certificate to a chain of two or more users who have assigned the owner right contains the delegatability parameter. Such an object, hereinafter also referred to as an ownership authorization chain object, can be generated, for example, in the form of a new copy and stored in the ID database as soon as a chain of users who have assigned the owner right for a user data database to a chain link (e.g. another user certificate) is extended. The delegatability parameter can either have the data value "DELEGATABLE" or the data value "NOT DELEGATABLE".

Embodiments can have the advantage that a high degree of dynamism and flexibility can be made possible with regard to the allocation of access rights: typically an owner certificate for a certain useful data database is allocated to a certain user, for example the manager. This “first / initial” owner certificate preferably has the delegation parameter value “DELEGATABLE”. This user can now assign this first owner certificate in an identical or modified copy to one or more other users via the first interface, so that these other users also receive owner rights with regard to the user data database and can create data records. The owner of the first owner certificate can decide whether the owner certificates assigned to the other users should also be delegable for this user data database, i.e. whether these other users should also be able to grant other users owner rights with regard to this user data database to exhibit. If a modified copy of the owner certificate is created for the one or more other users, which has the delegation parameter value "NOT DELEGATABLE", the other users can create a database connection to the user data database and generate data records there, but no further owner certificates. Issue certificates for other users with regard to this user data database. The chain of issued owner certificates therefore necessarily ends with the issuance of owner certificates that cannot be further delegated, whereby it is of course possible for a specific user to be issued a delegable owner certificate by one database owner and by another database owner a non-delegable owner certificate. In this case, the user can issue further owner certificates for third parties, but the chronological chain of the users issuing an owner certificate is preferably stored, for example in the form of authorization objects and / or log entries, so that the path of the chain of responsibility is documented. This chronological chain is preferably stored in a special database, hereinafter referred to as the “ID database”. In an analogous manner, the delegatability parameter can be stored within an assignment object, e.g. an ownership authorization chain object, and specify whether a user may create further assignment objects (further ownership authorization chain objects) in order to assign an owner certificate to other users.

• - Signierung des Berechtigungstoken durch die ID-Datenbank mit dem Signierschlüssel, wobei der Berechtigungstoken in signierter Form an die Nutzdaten-Datenbank übermittelt wird; und
• - Prüfung, durch die Nutzdaten-Datenbank mittels des Signaturprüfschlüssels, ob die Signatur des Berechtigungstoken valide ist, wobei der Aufbau der Datenbankverbindung zwischen Anfrageeinheit und Nutzdaten-Datenbank und der Datensatzzugriff nur dann gestattet wird, wenn die Signatur valide ist.

According to embodiments, the ID database includes a private signing key. The user data database includes a public signature verification key which is designed to verify the signatures created with the signature key. The monitoring system is configured to:

• - Signing of the authorization token by the ID database with the signing key, the authorization token being transmitted in signed form to the user data database; and
• - Check, through the user data database by means of the signature verification key, whether the signature of the authorization token is valid, the Establishment of the database connection between the query unit and the user data database and data record access is only permitted if the signature is valid.

Embodiments can have the advantage that the user data database can use the signature to check that an authorization token was actually generated by the ID database and not by an untrustworthy third party.

According to embodiments, the ID database of the monitoring system performs a certificate chain check in the course of generating the authorization token including one of the owner certificates in order to determine whether this owner certificate can be checked in the certificate chain of the user certificate to which this owner certificate is in one of the Ownership chain objects assigned is involved. The authorization token is only signed if successful integration is established.

In addition or as an alternative to this, the ID database carries out a certificate chain check in the course of generating the authorization token containing one or more access certificates from a producer-user (producer of a data record) in order to determine whether this access has been made for each of the user's access certificates -Certificate is verifiably incorporated into the certificate chain of the user certificate to which this access certificate is assigned in one of the access authorization chain objects, the authorization token being signed only if successful integration is established. The generation of the authorization token and the associated certificate chain check can be part of the further check.

According to embodiments, the monitoring system includes a software or hardware-based access management system. The access management system can be configured to provide a graphical user interface (GUI). The GUI enables users of an organization to create additional owner certificates for other manually selected users (e.g. monitoring systems) for a specific user data database, provided that the issuing user himself has been assigned a corresponding owner certificate in the ID database. In addition, this user interface can enable the user who has created a particular data record to grant one or more selected access rights to this data record to one or more other users selected manually via the GUI or other monitoring systems represented by them. For example, the GUI can graphically represent several people or monitoring systems in the form of a selectable list of people or monitoring system list, so that a user of the GUI can specify the recipients of the owner and access rights to be granted by selecting one or more elements from this list. Further selectable GUI elements, for example radio buttons or check boxes, can enable the user of the GUI, by selecting this element, to set the delegation parameters of the access or access issue. To determine the owner certificate (delegable or non-delegable), provided that the user's authorization is sufficient. The GUI can also have selectable GUI elements that enable a user to revoke access rights that he has granted to other users or monitoring systems. The GUI is configured in such a way that it automatically creates or invalidates new certificates and / or assignments of certificates to users or monitoring systems in the background according to the inputs of the user via the GUI and updates the content of the ID database accordingly.

According to embodiments, the one or more useful data databases and the ID database are each a NoSQL database, that is to say a database of a NoSQL database system. The NoSQL databases are each preferably a so-called "structureless" database that supports a free definition of the type and number of data fields. The NoSQL database is preferably configured in such a way that the content of all data fields of each new data record is automatically indexed and that changes to the content of the database are stored in the form of new versions (“versioned database”). The generation of new access and / or owner certificates and the chronological sequence of the users who have each assigned these certificates to other users are preferably stored in a log (e.g. log file) of the ID database.

According to embodiments, the access management system is a database system. However, it is also possible for the access management system to be implemented in the firmware or software of the microcontroller, in whose memory the certificates and authorization chain objects and the program logic described here can be implemented.

According to embodiments, a first user is assigned to the monitoring system that receives the request, or the monitoring system itself is treated as the first (virtual) user. A first user certificate is assigned to the first user. The first user certificate can, for example, be a root certificate that is issued by a certification authority (CA) for a specific organization, or a certificate that can be verifiably derived from the root certificate. The first user certificate is arranged in a testable manner in a first certificate chain issued by a certification authority (that is, for example, it can be tested up to the root certificate of the certification authority). This can be advantageous because certification bodies are already widely accepted as independent guarantors of trust and are already used by many existing technical systems to check the authenticity of certain users and user actions.

According to embodiments, the owner certificate for the first user, who certifies his ownership of the user data database, is created in such a way that it is classified in the first certificate chain and can be checked by the first user certificate. For example, the owner certificate is signed by the access management system using the private key of the first user certificate. In an analogous manner, the first user can also provide copies of access certificates that grant other users (e.g. other monitoring systems or the query unit) access to the data records created by the first user, with the private key of his user certificate (in this case the first user) Certificate).

According to embodiments, a second user certificate is assigned to a second user (also called "query user", e.g. other monitoring systems or the query unit), the second user certificate being verifiable in a second certificate chain issued by a certification authority.

According to embodiments, the method includes the creation of a third owner certificate by the second user and linking the third owner certificate to a third user in order to enable the third user to create data records in the user data database.

According to embodiments, access certificates, as already described for the owner certificates, are created as delegable or non-delegable access certificates and assigned to other users. The assignment itself, i.e. the access authorization chain objects, can also be delegable or non-delegable. So every creator of a data record and every holder of a delegable access certificate of another user who has created a data record can flexibly decide for himself whether and to what extent he or she represents the access responsibility and related duties and activities to or through other users Surveillance systems transmits. This can be advantageous as it allows a high degree of flexibility and complexity in granting access.

According to embodiments, a large number of user certificates, a large number of access certificates and a large number of owner certificates are stored in an ID database. The method includes storing ownership chain objects and / or access chain objects in the ID database.

According to embodiments, each ownership chain object is a data object that contains (and thereby assigns) one of the owner certificates and one or more of the user certificates. The ranking of the user certificates in the ownership authorization chain object reflects the sequence of users who have created and assigned this ownership certificate for other users in each case.

Each access authorization chain object is a data object which contains one of the access certificates and one or more of the user certificates (and thereby assigns them to one another). The sequence of the user certificates in the access authorization chain object reflects the sequence of users who have issued this access certificate for other users in each case.

According to embodiments, the user data databases are free of access authorization chain objects and for each data record only contain the access certificates that grant the user who created this data set access to this data record.

The linking of these access rights of the data set creator with one or more other users in order to grant this access to the data set is not stored in the user data database, but in the ID database. Conversely, the ID database does not contain any reference to individual data records in the user data databases. This can be advantageous since the size and complexity of the individual data records in the user data database are limited and logically largely decoupled from the administration of the access rights. The size of the data records is also limited by the fact that the complete chain of authorization transfers is not saved as part of the data records. This can considerably reduce the storage space required by the database, especially when there are a large number of small data records with an identical authorization structure.

According to embodiments, the ID database carries out a certificate chain check in the course of generating the authorization token which contains one of the owner certificates. This is done to determine whether this owner certificate can be checked in the certificate chain of the user certificate to which this owner certificate is in one of the Ownership chain objects is assigned. The ID database only signs the authorization token if it has been successfully integrated into the certificate chain of the owner certificate. This certificate chain check can therefore take place in particular along the certificate chain of the certification authority that issued the user certificate as the root certificate for an organization or for a functionally related group of monitoring systems. In addition or as an alternative to this, the ID database carries out a certificate chain check in the course of generating an authorization token which contains one or more access certificates of a user for access to data records created by him in order to determine whether for each of the access certificates of the user this access certificate can be checked in the certificate chain of the user certificate to which this access certificate is assigned in one of the access authorization chain objects. The ID database only signs the authorization token if it has been successfully integrated.

According to embodiments, the second user (e.g. the query unit or another external monitoring system) who has created a certain data record in the user data database of the monitoring system, or a third user who is assigned one or more access certificates of the second database user via an access authorization chain object are another access authorization chain object. In this further access authorization chain object, one or more access certificates of the creator (that is, of the second user) are assigned to the fourth user. The user data database is configured to check, before the fourth user grants access to the data record generated by the second user, whether the fourth user has been assigned one or more of these access certificates. The check takes place, for example, when the further monitoring system represented by the fourth user sends an access request.

According to one embodiment, one or more access certificates of the user creating the data record is assigned to each of the data records in the user data database.

According to embodiments, the data records are stored in the user data database in a format which excludes extraction of the information contained in the data records without access to the user data database via a database connection. For example, the data records can be stored as binary objects or in encrypted form. Backups of the user data database can be created by copying the user data database to another storage medium, whereby the user who creates these backups does not have or does not have to have an owner certificate for this user data database. For example, the backup creation can be initiated by a large number of monitoring systems by an administrator user through a backup request. The administrator user can be a person or a super-monitoring system which, in addition to its function of monitoring the monitoring object coupled to it, also performs various coordinating and / or administrative tasks with regard to several other, subordinate monitoring systems.

This can be advantageous because an administrator user can still carry out the activities typically assigned to him, such as creating backups, but can no longer access the content of the user data stored in the database. This protects the organization by improperly passing on sensitive status data of the surveillance objects to third parties by the administrator user, for example in the context of industrial espionage. According to embodiments of the invention, the administrator user of the access management system or the monitoring system therefore has significantly fewer access rights than is the case in conventional IT systems.

According to embodiments, each or at least some of the data records in the user data database each represent a software or hardware functionality that the monitoring system provides and / or controls. Only one user (e.g. request unit or other external monitoring system), who has been assigned both an owner certificate for the user data database and an access certificate for access to the functional object, will receive the request from the access management system of the monitoring system , allows to carry out the functionality or to cause the function to be carried out. The function can be, for example, starting a device, activating or moving a hardware component, opening or closing a door for buildings, rooms or vehicles, opening or closing other access barriers or locking devices for containers or a specific software functionality .

Thus, the advantageous, flexible and fine-grained access control described above can be used not only for controlling access to data sets, but also for controlling access to a large number of other functions, including hardware functionalities.

In another aspect, the invention relates to a distributed system. The distributed system comprises several monitoring systems according to one of the embodiments described here.

According to embodiments, each of the monitoring systems of the distributed system is in each case coupled to a different monitoring object. Each of the monitoring systems is designed to function as the query unit and to send a query to one of the other monitoring systems, as is described here, for example, for embodiments of the invention. Each of the monitoring systems is designed to receive a request from one of the other monitoring systems and to check this in the same way as the request from the requesting unit.

For example, the multiple monitoring systems of the distributed system can each be operatively coupled to monitoring objects that are components of a complex, multi-component physical object.

For example, the complex object could be a building, a vehicle, an airplane, a military installation, an industrial installation, a power plant or a hospital. The individual monitoring systems and the monitoring objects coupled to them each form semi-autonomously monitored systems. This means that the monitoring of the respective monitoring objects is carried out largely by the respectively coupled monitoring system alone, without the aid of other monitoring systems or central control systems. By exchanging inquiries and the resulting exchange of e.g. measured values, of data and / or control signals derived from the measured values, the functionality of the distributed system as well as that of the individual monitoring systems can be significantly improved in embodiments of the invention. For example, a monitoring system that has recognized technical problems in “its” monitoring object can communicate this observation to other monitoring systems by means of corresponding inquiries. This enables the other monitoring systems to quickly send the correct control signals to their "own" monitoring objects in order to ensure that the complex object continues to work correctly. If, for example, a certain monitoring system detects that "its" monitoring object, a petrol tank, is about to run out of fuel, it can transfer this knowledge to a monitoring system that is responsible for vehicle components that consume energy but are not essential for locomotion, e.g. an air conditioning system. The request can e.g. have a control signal to reduce the power of the air conditioning system in order to save fuel. Such systems can have the advantage that central control of all components or all monitoring systems is no longer necessary. This also increases the security and robustness of the monitoring, because there is no longer a central monitoring instance whose damage would lead to the failure of the entire complex object and all control systems.

According to embodiments, the requests serve to exchange measured values, data derived from the measured values (e.g. trained ML models) and / or control signals between the monitoring systems. The measured values are data values which were recorded by the sensors and which contain status-related information of the monitored objects. The control signals are data values which are designed to cause the control unit of the monitoring system that has received the control signals to control the monitoring object which is operatively coupled to this monitoring system in accordance with the control signals.

According to embodiments, each of the monitoring systems includes a prediction program. Each of the prediction programs contains a machine learning (ML) model trained to calculate the same type of prediction. A type of forecast can be, for example, a certain forecast problem, e.g. the calculation of the probable point in time at which a component has to be replaced due to material fatigue. The trained models of the prediction programs are different. Each of the ML models includes pairs of associated inputs and outputs. For example, each of these ML models can have learned this input-output assignment on the basis of training data that was recorded by the sensor of the respective monitoring system and stored locally, the training data containing status data of the respective monitored object.

• - Synchronisieren der Eingabe-Ausgabe Paare der Modelle derart, dass jedes Modell nach der Synchronisation den gleichen Satz an Eingabe-Ausgabe Paaren beinhaltet;
• - Eingeben von Eingabedaten in eines der Vorhersageprogramme;
• - Berechnen einer Vorhersage auf Basis der Eingabedaten durch das eine Vorhersageprogramm unter Verwendung des synchronisierten Modells dieses einen Vorhersageprogrammes; und
• - Verwendung der Vorhersage durch die Steuereinheit desjenigen Überwachungssystems, welches das eine Vorhersageprogramm beinhaltet, um den Zustand des an dieses Überwachungssystem operativ gekoppelten Überwachungsobjekts automatisch in Abhängigkeit von der Vorhersage zu verändern. Zusätzlich oder alternativ dazu kann das Überwachungssystem die Vorhersage an die Anfrageeinheit zurückgeben. Beispielsweise kann die Anfrageeinheit die Durchführung der Vorhersage mittels der Anfrage veranlasst haben und die Vorhersage wird in Antwort auf die Anfrage zurückgegeben.

Each of the monitoring systems is configured to:

• - Synchronizing the input-output pairs of the models in such a way that each model after the synchronization contains the same set of input-output pairs;
• Inputting input data into one of the prediction programs;
• - Calculation of a prediction on the basis of the input data by the one prediction program using the synchronized model of this one prediction program; and
• Use of the prediction by the control unit of that monitoring system which contains the one prediction program in order to automatically change the state of the monitoring object which is operatively linked to this monitoring system as a function of the prediction. Additionally or alternatively, the monitoring system can return the prediction to the query unit. For example, the query unit can have caused the prediction to be carried out by means of the query, and the prediction is returned in response to the query.

In a further aspect, the invention relates to a system comprising the monitoring system according to one of the embodiments described here and a monitoring object which is operatively coupled to this monitoring system.

• - operative Kopplung eines Überwachungssystems an das Überwachungsobjekt, wobei das Überwachungssystem ein mikrocontroller-basiertes oder mikroprozessor-basiertes Datenverarbeitungssystem ist. Das Überwachungssystem umfasst zumindest einen Prozessor, eine Netzwerkschnittstelle, und zumindest einen Sensor, der dazu ausgebildet ist, bei bestehender operativer Kopplung an das Überwachungsobjekt einen aktuellen Zustand des Überwachungsobjektes zu erfassen. Zusätzlich oder alternativ zu dem zumindest einen Sensor umfasst das Überwachungssystem eine Steuereinheit, die dazu ausgebildet ist, bei bestehender operativer Kopplung an das Überwachungsobjekt den Zustand des Überwachungsobjektes durch Senden eines Steuerbefehls an das Überwachungsobjekt zu verändern;
• - Empfang einer Anfrage über die Netzwerkschnittstelle von einer Anfrageeinheit durch das Überwachungssystem;
• - Durchführung einer ersten Prüfung der Anfrage durch das Überwachungssystem;
• - Falls die erste Prüfung ergibt, dass die Anfrage nicht vertrauenswürdig ist, Abbruch der ersten Prüfung durch das Überwachungssystem, ohne eine Antwort irgendeiner Form an die Anfrageeinheit zurückzugeben;
• - nur falls die erste Prüfung ergibt, dass die Anfrageeinheit vertrauenswürdig ist, Durchführen einer weiteren Prüfung der Anfrage durch den Prozessor des Überwachungssystems;
• - nur falls die weitere Prüfung der Anfrage ergibt, dass die Anfrageeinheit hinreichend berechtigt ist, Ermöglichung der Übertragung von Zustandsdaten des Überwachungsobjekts, die von dem zumindest einen Sensor erfasst wurden, an die Anfrageeinheit durch das Überwachungssystem und/oder Ändern des Zustands des Überwachungsobjekts mittels der Steuerungseinheit gemäß der Anfrage durch das Überwachungssystem.

In a further aspect, the invention relates to a method for monitoring a surveillance object. The procedure includes:

• operational coupling of a monitoring system to the monitoring object, the monitoring system being a microcontroller-based or microprocessor-based data processing system. The monitoring system comprises at least one processor, a network interface, and at least one sensor which is designed to detect a current state of the monitoring object when there is an operational coupling to the monitoring object. In addition or as an alternative to the at least one sensor, the monitoring system comprises a control unit which is designed to change the state of the monitoring object by sending a control command to the monitoring object when there is an operational coupling to the monitoring object;
• - Receipt of a request via the network interface from a request unit by the monitoring system;
• - Carrying out a first examination of the request by the monitoring system;
• If the first test shows that the request is not trustworthy, the first test is aborted by the monitoring system without returning a response of any form to the request unit;
• - only if the first check shows that the query unit is trustworthy, carrying out a further check of the query by the processor of the monitoring system;
• - only if the further examination of the request shows that the request unit is sufficiently authorized, enabling the transmission of status data of the monitoring object, which was recorded by the at least one sensor, to the request unit by the monitoring system and / or changing the status of the monitoring object by means of the Control unit as requested by the monitoring system.

This can be advantageous since embodiments provide a monitoring system which can receive requests over a network, e.g. the Internet, and thus can be used for complex applications in the IoT context. At the same time, the monitoring system can effectively fend off DoS attacks despite possibly poor performance of the existing microprocessors. For example, the multi-stage check, the complete absence of a response and, if necessary, a connection break and, if necessary, also the prevention of a renewed connection to the request unit for a predefined minimum time in the event of a negative result of the first check ensure that attackers neither paralyze nor paralyze the monitoring system find out more information about the surveillance system.

According to embodiments, the method is used for a monitoring of the monitoring object that is robust, i.e. protected, against denial-of-service attacks.

“Monitoring” is understood here to mean the acquisition and storage of states of a monitored object and / or the control of states of this object.

A “data processing system” is understood here to mean an electronic system which is designed to process amounts of data with the aim of obtaining information about these amounts of data or to change these amounts of data. In particular, the data processing system can be one on one or more integrated circuits with one or more microprocessors or a microcontroller-based digital computer, in particular an “embedded system”.

A “chain object” is understood here to mean a data structure which contains several elements that are arranged in the data structure in a specific sequence (“chain”) and are thereby assigned to the respective neighboring element or elements. The assignment can be based purely on the positioning of the elements within the sequence as neighboring elements. In some embodiments, some or all of the elements consist of certificates, the certificates within the sequence not only being assigned to one another on the basis of their position but also by the fact that the certificates form a certificate chain that is established by a so-called certificate chain check along the Certificate sequence can be checked. The sequence of the elements is preferably determined by a user, for example a human user or software, a query unit, a monitoring system, hardware or a software or hardware-based process that functions as a “user”. For example, chain objects can contain a first element that represents a right, for example an access right (the first element can then be, for example, an access certificate) or an owner right (the first element can then be, for example, an ownership certificate). The chain object can also contain a sequence of further elements, for example elements that each represent a user (these further elements, for example, can be designed as user certificates, for example as X.509 certificates). The sequence of user certificates in the chain object represents the sequence of users who have each transferred the right represented in the first element that belongs to them to another user. For example, an “access authorization chain object” is a chain object that represents an access right and a sequence of users who have transferred this access right to one of the other users in accordance with this sequence. For example, an “ownership authorization chain object” is a chain object that represents an owner right and a sequence of users who have transferred this owner right to one of the other users in accordance with this sequence.

A “query unit” is understood here to mean a physical object, e.g. a data processing system or software, which is configured to send a query to a monitoring system via a network. The request can, for example, have the purpose of causing the monitoring system to carry out a certain software-based or hardware-based functionality, e.g. to send recorded and logged status data of the monitoring object to the request unit, to grant the request unit access to corresponding data records or the control unit in response to the request to cause a control command to be sent to the monitored object in order to change its state. The query unit can be, for example, a standard computer or another microcontroller-based or microprocessor-based monitoring system. The latter can be a monitoring system according to embodiments of the invention, which in turn can receive queries from other monitoring systems functioning as query units and process them as described. Embodiments of the invention can have the advantage that a network of monitoring systems is provided, which form a network of IoT end nodes, each end node being able to act dynamically as a request unit and receiver for requests from other monitoring systems and depending on the content and the test results of the request then monitors the respectively assigned monitoring object, i.e. releases status data or actively changes the status. For example, the network can serve to exchange measured values recorded locally by the monitoring systems and / or to synchronize ML models obtained between the monitoring systems on the basis of these measured values in the course of a local training process.

A “proof of authorization” is understood here to mean a data value, in particular a numerical data value, which has the function of identifying the bearer of this data value as trustworthy to the recipient. This can include that the bearer of this data value is identified as authorized to cause the monitoring system receiving the authorization to carry out a certain function or a certain process (e.g. further test step). It is preferably a numerical value of sufficient length and complexity so that it cannot simply be guessed with the aid of a random generator in a few query cycles. For example, the numerical value can contain at least 5, preferably at least 8 digits.

According to embodiments, after receiving a minimum number of queries from the same query unit, all of which do not contain a valid credential, the monitoring system blocks this query unit permanently or for a certain minimum duration, e.g. a few minutes, a few hours or a few days. The minimum number can be "1" or a higher value. Embodiments can have the advantage that in this way accidental guessing of the credentials, e.g. by means of random generators, can be effectively prevented.

A “reference authorization” is understood here to mean a data value, in particular a numerical data value, which is stored in a monitoring system and which legitimizes the carrying out of a data value identical to this reference authorization (e.g. an inquiry unit) as authorized by the monitoring system that has received the authorization to initiate a certain function or a certain process (e.g. further test step). For example, reference credentials can be the sum of all access certificates that were saved in the course of the registration of various users (eg monitoring systems) in the recipient monitoring system. The reference credentials can also contain the access certificates that lead to a later assigned to these registered users and saved in the recipient monitoring system.

A “microprocessor” (also called a microprocessor) is understood here as a processor (typically on a very small scale) in which all the components of the processor are combined on a microchip (integrated circuit, IC). According to embodiments, the chip also contains additional peripheral components in addition to the microprocessor. Such a chip with one or more microprocessors and one or more peripheral components (such as sensors and / or control units for chip-internal or chip-external functions and systems) is called a microcontroller, also known as "System-on-a-Chip (SoC)" , designated.

A “microcontroller” (also µcontroller, µC, MCU) refers to semiconductor chips that contain at least one processor and at the same time also peripheral functions. The at least one processor can be designed as a microprocessor. These peripheral functions can, for. B. CAN (Controller Area Network), LIN (Local Interconnect Network), USB (Universal Serial Bus), I ² C (Inter-Integrated Circuit), SPI (Serial Peripheral Interface), serial or Ethernet interfaces , PWM outputs, LCD controllers and drivers, and analog-to-digital converters. Some microcontrollers also have programmable digital and / or analog or hybrid function blocks. In many cases, the work and program memory are partly or completely on the same chip. A microcontroller is a one-chip computer system. The term system-on-a-chip or SoC is also used for some microcontrollers. Microcontrollers are adapted in performance and equipment according to embodiments to the respective application. Therefore they have advantages over “normal” computers in terms of costs and power consumption. Small microcontrollers are available in higher numbers for a few cents.

Examples of microcontrollers currently or in the past on the market are e.g. B. the Intel 80186 (derived from the 8086), the XScale family (ARM) and ColdFire (MC680xx) from Freescale (formerly Motorola). For example, a microcontroller can be based on 8-bit processors, but there are also 4-, 16- and 32-bit microcontrollers.

A “microcontroller-based monitoring system” is understood here to mean a data processing system whose functionality is essentially or completely based on one or more microcontrollers.

In some cases, microcontrollers are used as part of a Multi Chip Module (MCM), with the MCM representing the monitoring system or an essential part of the monitoring system. For example, such MCM-based monitoring systems can be used to combine different semiconductor processes that can be combined poorly or not at all on one chip. Examples of this are combinations of microcontrollers with high-frequency circuits for radio connections (e.g. Atmel, Cypress, Microchip manufacture such MCMs), with power electronics (e.g. Freescale, ST) or with Flash ROM in its early days (e.g. Micronas Intermetall). In some cases, the solution with an MCM is also used when existing chips are to be combined with one another, but the effort for a new design is to be avoided. Examples of this are combinations with network controllers or the connection drivers for networks (PHY) or LCD controllers.

In contrast, a monitoring system according to embodiments can also be based on a “classic” microcontroller architecture, which was not intended from the start as a pure microprocessor system, but is primarily aimed at control tasks. Such an architecture is characterized e.g. B. in that single-chip operation is possible with it completely without external memory modules, just as the instruction set of the CPU mostly offers specialized commands for controlling individual signal lines (by means of so-called bit manipulations). Such microcontroller-based monitoring systems are often characterized by a very short interrupt latency, i.e. the time that the controller needs to react to the interrupt request from a signal source (timer, peripheral module, etc.). Typical representatives of this genus are z. B. the 8051 from Intel as well as the C166 from Siemens (today Infineon) and Infineon TriCore. So-called watchdog circuits, for example, can be used to monitor the functioning of microcontroller controls, some of which are already integrated into the microcontroller.

A “microprocessor-based monitoring system” is understood here to mean a data processing system that contains one or more microprocessors and uses them to control additional components of the monitoring system such as sensors and / or control units for internal and / or external functions of the monitoring system.

An “embedded system” is understood here to mean a microcontroller-based monitoring system that is integrated into a physical object with a specific function. For example, the monitoring system can be in the form of an embedded system in the form of a technical Consumer articles, vehicles, building components, machines, machine components, in particular sensors or control units. Washing machines, chip cards (money cards, phone cards), entertainment electronics (video recorders, CD / DVD players, radios, televisions, remote controls), office electronics, Segways, motor vehicles (control devices for e.g. ABS, airbags, motors, instrument clusters, ESP, etc. .), Cell phones, and clocks and watches are examples of embedded systems. In addition, embedded systems are contained in practically all computer peripheral devices (keyboard, mouse, printer, monitor, scanner, etc.).

A “query unit” is understood here to mean a data processing system that is designed to generate a query and send it to one or more monitoring systems via a network, e.g. the Internet. A request can have different content. It can, for example, request data from the monitoring system, or access to the data and / or functions contained in the monitoring system. The request can also relate to the implementation of a control function which can determine or change the current state of the monitoring object. According to some embodiments, the query unit is a monitoring system according to one of the embodiments of the invention described here.

A “monitoring object” is understood here to mean a physical object that can assume several different states.

An "infrastructure object" is understood here as a physical object that is part of the infrastructure of a human collective (e.g. organization, company, village, city, nation, etc.). The physical object can be, for example, a building, building technology components, an energy generation system, a military system, a device, a machine, a device or a component of the aforementioned infrastructure objects. An infrastructure object typically implements one or more functions that are necessary or beneficial for the functioning of the respective infrastructure. This function can be, for example, control functions, monitoring functions, data exchange functions and other calculation functions.

“Operational connectivity” is understood here to mean the ability of a monitoring system, after a mechanical and / or software-based coupling to a monitoring object, is designed to detect and / or control states, in particular performance and error parameters, of the monitoring object. The operational linkability can consist in the establishment of a communication connection for the exchange of measurement data and / or control commands. For example, the monitoring system can contain one or more sensors which, after coupling, are capable of sensing and / or receiving state parameters of the monitored object. Additionally or alternatively, the monitoring system can have a control unit which is designed to cause the monitoring object to perform one or more functions after the coupling by generating and sending control commands. Depending on the monitoring system, sensor, control unit and monitoring object, the operative coupling can consist, for example, in the establishment of a wired data exchange channel, in the establishment of a wireless communication link, e.g. via radio or infrared, in the form of a mechanical attachment of the monitoring system and / or its sensor to the monitored object.

“User data” is understood here to mean data that is relevant for a user, for a workflow or for hardware or software functionality outside of the access management system containing them and which are not used to manage the access rights of different users of an access management system. User data can in particular include measured values, text, characters, images and sounds. For example, the useful data can contain status data from one or more monitoring objects that were recorded by the sensor of a monitoring system that is operatively coupled to the monitoring object.

A "NoSQL" (English for Not only SQL) database is a database that follows a non-relational approach and does not require any fixed table schemes. The NoSQL databases include in particular document-oriented databases such as Apache Jackrabbit, BaseX, CouchDB, IBM Notes, MongoDB, graph databases such as Neo4j, OrientDB, InfoGrid, HyperGraphDB, Core Data, DEX, AllegroGraph, and 4store, distributed ACID databases such as MySQL Cluster, Key -Value databases such as Chordless, Google BigTable, GT.M, InterSystems Cache, Membase, Redis, sorted key-value memories, multivalue databases, object databases such as Db4o, ZODB, column-oriented databases and temporal databases such as Cortex DB.

In the following, an “access management system” is understood to mean an electronic system or software for storing and retrieving data and for managing access rights with regard to this data. For example, the access management system can be a “database management system” (DBMS). In some embodiments, it is Access management system stored in a program memory of a microcontroller-based data processing system. The data are preferably stored consistently and permanently in the access management system and are efficiently made available to various application programs and users in a needs-based form. A database management system can typically contain one or more databases and manage the data records contained therein.

In the following, a “data record” is understood to be a content-related amount of data that is jointly managed by a database management system. A data record typically represents the smallest structural unit of the data in a particular database.

In the following, a “database” is understood to mean a (typically large) amount of data that is managed in a computer system by an access management system according to certain criteria.

In the following, an “ID database” is understood to mean a database which contains and manages user-related information such as user certificates and the rights assigned to these users in the form of further certificates. In contrast to user data databases, which are mainly used to store user data, the ID database is mainly used to manage the owner and access rights assigned to users with regard to user data.

In the following, a “user” is understood to mean the digital representation of a human person or a physical object, in particular a software program or a data processing system, in particular a monitoring system and / or an inquiry unit. For example, a user can send a request to a monitoring system, the further processing of the request by the monitoring system may depend on whether the sending user is "known" to the receiving monitoring system, i.e. the sending user is in the monitoring system that receives the request , is registered. The digital representation can, for example, be registered with an access management system that is instantiated on this monitoring system.

In the following, a “certificate” is understood to mean a data value which represents a property (e.g. identity of a user) or a right (e.g. access right) and is authenticated (“certified”) to third parties. The certificate either contains the data required for its verification itself or is stored linked to certificate-related metadata, so that the data required for its verification can be obtained from the metadata.

A certificate can be a simple data value, in particular a numerical value. In particular, an access certificate can be represented as a simple numerical value.

For example, the certificate can be designed as a numerical value to which metadata is assigned in the ID database. The use of numerical values can be advantageous because they are easy to index and can be checked or compared quickly and are not subject to variation due to slightly modified metadata. The access certificates of individual users are preferably designed as attribute certificates, in particular as numerical values. Attribute certificates do not contain a public key, but refer to a public key certificate and define its scope more precisely.

Alternatively, a certificate can also be a more complex digital data record that confirms certain properties of users or other objects and makes its authenticity and integrity verifiable using cryptographic processes. The certificate can be designed, for example, according to the X.509 standard, i.e. it can contain a public key and confirm the identity of the owner and other properties of the public cryptographic key of the certificate.

The certificate can be issued - e.g. in the case of user certificates - by an official certification authority, the Certification Authority (CA).

A certificate can, but does not necessarily have to refer to a cryptographic key, but can generally contain data for checking an electronic signature or be stored linked to this data.

In the following, a “root certificate” or “root certificate” refers to the certificate that represents the trust anchor of a PKI. Since the root certificate and thus the entire certificate hierarchy can only be trusted as long as its private key is known exclusively to the issuing party, protecting the root CA is of the utmost importance.

According to some embodiments, the user certificate of that user who is at the top of the hierarchy of an organization represents the root certificate of the PKI of this organization. The user certificates of all other members of this organization are from the private key of this root certificate signed and with it dependent on this according to a certificate chain hierarchy. Due to the high protection requirements of the root certificate, signature or encryption requests are automatically processed with sub-certificates that were signed with the root certificate and have a shorter validity (usually a few months to years) than the root certificate (which usually has several Years or decades). For example, the user certificates of other users and / or the owner certificates, access certificates and / or attribute certificates issued or transferred by individual users can have a limited period of validity of a few days or months. The validity of the sub-certificates is chosen so that it can be regarded as improbable that the private keys belonging to the sub-certificates can be calculated within the selected period of validity with the currently available computing capacity. In this way, a certificate chain is created, in which the signing certificate is referred to as the issuing body. This chain is usually supplied as part of a certificate in order to enable a check with regard to trustworthiness, validity and, if necessary, existing certificate revocation along the entire certificate chain.

An "owner" or "owner" is understood in the following to be a user who has been granted the right to create data records in a specific user data database and to establish a database connection with this database by assigning an owner certificate. According to the design, all owner certificates that were issued for the user data databases of the monitoring system are derived from the user certificate (“CEO certificate”) of the user who holds the highest position within the organization that operates the monitoring system. The derivation from this user certificate means that every copy of this owner certificate can be checked for validity by means of a certificate chain check, whereby the certificate chain used for the certificate chain check contains the “CEO user certificate”.

In the following, an “authorized user” with regard to a certain data record is understood to mean a user who has been granted the right to access a data record that contains this access certificate in the manner specified in this by assigning an access certificate Access certificate or is specified in metadata of this access certificate, provided that other necessary criteria, such as ownership of the database containing the data record, are optionally met.

The use of ordinal numbers such as first, second, third, etc. is used here, solely to differentiate between elements and / or people with otherwise the same designation and is not intended to imply a specific sequence. Furthermore, elements and / or persons whose designation differs solely through an ordinal number can be identical or different elements or persons, unless the specific context clearly indicates otherwise.

Figure list

• 1 ein Blockdiagramm einer Ausführungsform eines erfindungsgemäßen Überwachungssystems;
• 2 ein Flussdiagramm einer Ausführungsform eines erfindungsgemäßen Verfahrens;
• 3 ein Blockdiagramm eines Systems mit einem kritischen Infrastrukturgebäude gemäß einer Ausführungsform, dessen Komponenten von Überwachungssystemen gesteuert wird;
• 4 ein Blockdiagramm eines verteilten Systems mit mehreren Überwachungssystemen gemäß einer Ausführungsform, die ML-Modelle von Vorhersageprogrammen synchronisieren;
• 5 ein Blockdiagramm eines Überwachungssystems mit mehreren Datenbanken,
• 6 den Vorgang der Erstellung von Berechtigungstoken für zwei Nutzer gemäß einer Ausführungsform,
• 7 den Ablauf der Einräumung von Zugriffsrechten über eine Sequenz von Nutzern,
• 8 Ein Beispiel für Nutzdaten, die Bestandteil eines Datensatzes sind,
• 9 zwei dynamisch und unabhängig voneinander generierte Hierarchien, entlang welcher einerseits Zugriffsrechte und andererseits Eignerrechte über eine Kaskade von Überwachungssystemen vergeben wurden, und
• 10 ein Flussdiagramm eines Verfahrens zur Übertragung von Eignerrechten und Zugriffsrechten von einem Überwachungssystem auf ein anderes.

Various embodiments of an inventive monitoring system and a corresponding method for operating such a monitoring system are illustrated in the drawings described below. Show in it:

• 1 a block diagram of an embodiment of a monitoring system according to the invention;
• 2 a flow chart of an embodiment of a method according to the invention;
• 3 a block diagram of a system including a critical infrastructure building, according to an embodiment, the components of which are controlled by monitoring systems;
• 4th FIG. 12 is a block diagram of a distributed system having multiple monitoring systems synchronizing ML models of prediction programs, according to an embodiment; FIG.
• 5 a block diagram of a monitoring system with multiple databases,
• 6th the process of creating authorization tokens for two users according to one embodiment,
• 7th the process of granting access rights to a sequence of users,
• 8th An example of user data that is part of a data record,
• 9 two dynamically and independently generated hierarchies, along which, on the one hand, access rights and, on the other hand, owner rights were assigned via a cascade of monitoring systems, and
• 10 a flow diagram of a method for transferring ownership and access rights from one surveillance system to another.

Detailed description

1 Figure 3 shows a block diagram of an embodiment of a monitoring system according to the invention 300 . The surveillance system 300 can in particular be designed as an end node of an IoT application, for example as a so-called “embedded system”. The surveillance system 300 includes a network interface 308 , e.g. one or more input / output ports through which the monitoring system 300 Data with one or more other monitoring systems, for example an inquiry unit 328 , which in turn can be a monitoring system according to one of the embodiments described here, via a network 326 can exchange. At the network 326 In particular, it can be an Internet connection that can be implemented, for example, via a cellular network or other telecommunication technologies.

For example, the monitoring system 300 serve to continuously monitor the cooling water pump of a power plant and in the event of a deviation in the pump output that is greater than a predefined permissible maximum deviation, send a warning to higher-level systems and / or independently remedy the problem by generating and sending corresponding control commands to the pump .

The surveillance system 300 includes a microcontroller 302 , on which one or more microprocessors 304 , a working memory 306 as well as a non-volatile program memory 310 are located. The program memory contains at least one or more reference credentials 312 in the form of numerical data values and a test program 316 . The test program 316 is trained to answer queries that the surveillance system 300 over a network 326 receives, to be checked and to answer or not to answer depending on the test result. The surveillance system 300 can be operatively linked to a monitoring object 334 which different states 336 can take. For example, the cooling water pump of the power plant can assume the states “switched off”, “ready”, “defective”, and “[VALUE]% of maximum speed”, where “VALUE” can be any number between 0 and 100 and the current speed the turbine indicates. The monitoring system includes a sensor 331 or several sensors that detect the speed of the pump and other status-related parameters of the pump and store them as a data record in the user data database. Each of the sensors can, for example, be used as a separate user in the ID database of the monitoring system 300 be represented.

According to some embodiments such as the one in 1 As shown, the monitoring unit includes a control unit 333 which is designed to send control commands to the monitoring object in order to control the state of the monitoring object and, if necessary, to change it. If the monitoring system determines, for example, that the speed of the pump is too low to generate the required water pressure, the control unit can 333 the monitoring system sends a corresponding command to the pump to increase the speed 334 send to adjust the pump power accordingly. In some execution forums, the monitoring system contains a prediction program which predicts for a future point in time that the pump output will not be sufficient, so that the pump output can be proactively adjusted in good time so that no pressure drop occurs.

According to one embodiment, a request unit 328 a request 322 for read access to a specific data record 106 of the monitoring system 300 over the network 326 to the surveillance system 300 send. The query unit can, for example, be a further monitoring system 328 which has essentially the same or similar components and functions as a monitoring system according to embodiments of the invention.

According to one embodiment, the request includes a credential 324 in the form of a numeric data value.

The test program 316 is configured to respond in response to receiving the request 322 initially only to carry out a first test. The first check is to check if the surveillance system 300 a numerical data value, here as reference authorization 312 is stored, which is identical to the received credentials 324 . For example, the reference authorization 312 within an ID database 136 be saved and the record 106 to which the access request relates, within a user data database 102 be saved. Both the ID database 136 as well as the user data database can be stored on the program memory 310 of the microcontroller 302 be saved.

If this first check shows that the monitoring system 300 none of the proof of eligibility 324 has saved an identical value, the monitoring system reacts 300 not on request. In particular, this does not send an error message to the request unit 328 so that a potential attacker does not receive any information about the surveillance system in response to a request 300 receives.

The test program 316 is configured to do so only if the first test reveals that the surveillance system 300 one to the Proof of Entitlement 324 identical value saved has to carry out another check. For example, the further check can be significantly more computationally complex and include a check as to whether the request contains further data values that authorize the requesting system to carry out the requested functionality or to read or write to change the requested data. The monitoring system only performs if the further check also shows that the requesting system has the appropriate rights 300 the requested functionality 314 the end. For example, the functionality 314 consist of the requested record 106 read out and returned to the request unit via the network.

For example, in the user data database 102 the performance figures (vibration parameter values, revolutions per minute, temperature, flow resistance, etc.) of the pump recorded continuously over a longer period of several years must be stored. The ones from the request unit in the request 322 requested functionality 314 may consist of the surveillance system 300 to read out and return the performance figures of the pump recorded within a certain period of time, for example the performance figures of the last month, or only those performance figures that were outside a specified normal range.

In other embodiments, the functionality 314 but also consist of the surveillance system 300 via the control unit 333 a control command to the pump 334 sends, which causes the pump to stop or increase its activity. Such manipulations on important components of security-critical infrastructure objects, such as power plants, must be protected from unauthorized access. Embodiments of the invention can be advantageous because they can offer a very complex and at the same time secure system and method in order to protect such components from unauthorized access. At the same time, monitoring systems according to embodiments of the invention can also be advantageous because they can offer reliable protection against DOS attacks.

2 shows a flowchart of an embodiment of a method according to the invention for monitoring a surveillance object 334 by means of a monitoring system 300 such as in 1 is shown.

In a first step 802 the monitoring system 300 provided and operational to the surveillance object 334 coupled. For example, the monitoring system 300 be a loT end node that is connected to other IoT end nodes via a network and is provided together with this. This network of IoT end nodes, each designed as a monitoring system and monitoring a monitoring object coupled to it, can be used to monitor several components of a complex infrastructure object such as pumps, emergency power generators, doors and gates in a semi-autonomous yet concerted manner . For example, the provision in the delivery of the monitoring system to a customer or the installation at the customer.

In a next step 804 the monitoring system receives 300 a request 322 from an inquiry unit 328 . The query unit can be a trustworthy monitoring system that works together with the monitoring system 300 and together with it forms an IoT. However, it can also be an attacker's device whose aim it is to get into the surveillance system 300 intrude or functionally disable it through a DOS or DDOS attack.

The surveillance system provides protection against such attacks 300 conducts a first check in step 806, which can be performed very quickly and with minimal computation. The first check only includes an analysis of whether the request contains proof of authorization 324 is contained in the form of a numerical data value identical to that in the monitoring system 300 stored reference authorization.

If this is not the case, the monitoring system breaks 300 in step 808 the test without sending a response, error message or other message to the query unit. In addition, the network connection to the query unit is preferably interrupted at least for a certain time. An attacker does not receive any information about the surveillance system 300 In the end, he doesn't even know whether the surveillance system is running 300 exists at all.

However, if the first check leads to a positive result, the monitoring system leads to step 810 carries out a further test, which is more computationally intensive than the first test and, for example, includes the test of further features with cryptographic methods and / or certificate chain test. If this check leads to the result that the request unit does not have the necessary rights to carry out the requested function, the monitoring system can in step 814 return an error message. For example, the monitoring system can assume that the query unit itself is trustworthy, since the query at least contained the credentials. But it can be There is a misconfiguration or the required additional rights could meanwhile no longer exist due to the passage of time or an active withdrawal of rights. In this case, it can make sense to inform the request unit of the reason for the negative result of the further check in the form of an error message so that it can correct the error if necessary and, for example, have a new user certificate issued for the request unit.

In the event that the further check is positive, i.e. the result is that the other required rights are available, the monitoring system enables 300 in step 816 it a person or the inquiry unit, the requested function 314 to execute. For example, the function 314 include that the request unit has access to the data from the sensor 331 recorded condition measurement values of the object 334 be provided via a push or pull mechanism.

Alternatively, the function 314 include evaluating the request to determine whether it contains instructions on how the state of the monitoring object is to be changed, and via the control unit 333 to send a corresponding control command to the monitored object.

In a further optional step 818, the monitoring system returns the result of the function execution to the query unit. For example, the function can include sending a control command to the monitoring object and the returned result includes a message that the control command has been issued and implemented.

3 Figure 3 shows a block diagram of a system 340 , that is a security-critical infrastructure object, e.g. a hospital 330 , and multiple surveillance systems 336 , 300 includes, each operationally connected to a surveillance object 332 , 334 are coupled and each via a control unit 342 , 344 , steer. The monitoring systems are designed to have components 332 , 334 of the infrastructure object to be monitored, the monitoring systems 300 , 336 are networked with each other and exchange data by means of queries.

In one example, includes a hospital building 330 several emergency power generators 334 , 332 , each of which is monitored and controlled by one of the networked monitoring systems. If the normal power supply fails, only one should 332 of the two emergency power generators are activated, the second 334 should only be activated if the first emergency generator cannot be activated or fails. The two emergency power generators are each monitored by one of the monitoring systems. To ensure that in the event of a failure of the normal power supply, only the first emergency generator 332 and only if it fails or cannot be activated the second emergency power generator 334 is activated, the first monitoring system swaps 300 , the first emergency generator 332 controlled, continuous data with the second monitoring system 336 that is the second aggregate 334 controlled, off. For example, the first monitoring system can send queries to the second monitoring system at regular intervals, for example once a second 336 send, with any request coming from the second monitoring system 334 in an in 2 The multi-level test process shown is classified as valid, a "suppression function" is activated. This means that a "normally" functioning first monitoring system 300 the activation of the second monitoring system 336 and with it the activation of the second emergency generator 334 actively suppressed. The successful function call causes the activation of the second emergency generator to be suppressed. If, however, the first monitoring system or the first emergency generator 332 cannot be activated or fails during operation, the first monitoring system can 300 no more "suppression requests" to the second monitoring system 336 send. The second monitoring system is configured to use its control unit for a certain minimum period of time in the absence of a suppression request 344 a control command to the second emergency generator 334 to send. The control command activates the unit 334 .

This is just one example of how direct communication between IoT end nodes can be particularly advantageous, especially in the context of security-critical infrastructure objects and emergency situations: if important components fail, such as the normal power supply, central control of several components by a central computer may not be possible. The fact that the individual monitoring systems, which are preferably battery-operated and can therefore work largely autonomously, communicate directly with one another make the entire system considerably more robust. By means of the multi-stage test method described, embodiments of the invention can ensure that sensitive functions can only be triggered by authorized monitoring systems and / or that the interoperability of the monitoring systems is not accompanied by the disadvantage of offering an easy target for DoS attacks.

4th Figure 3 shows a block diagram of a distributed system 900 with multiple monitoring systems 902 , 902.2, 902.3, each over a network, for example the Internet, with each other are connected. Each of the monitoring systems includes a microcontroller with one or more microprocessors 904 , 904.2, 904.3. Any of the surveillance systems 902 , 902.2, 902.3 is operationally connected to a corresponding monitoring object 920 , 922 , 924 coupled.

For example, the operational coupling includes the establishment of a data exchange channel between the monitoring system and the monitoring object.

The monitoring systems can be of essentially the same or similar type. For example, the monitoring objects can be cooling water pumps for power plants. The monitoring systems can be so-called "embedded systems" that are already operationally linked to the pumps by the manufacturer of the pumps. For example, each of the microcontrollers can have a rotation sensor 916 , 916.2, 916.3, which can measure the current number of revolutions of the pump and store it in a local data memory of the respective monitoring system. The sensors 916 , 916.2, 916.3 can include further sensors that are not shown here, for example sensors for vibration states of the respective monitored object, which provide information about the degree of material fatigue of the respective object.

According to embodiments, the measurement data captured by the sensors are stored locally, e.g. in a user data database, and used as a training data set for training a statistical predictive model, also called a “machine learning model” or “ML model”.

For example, each of the monitoring systems can have a prediction program 906 , 906.2, 906.3 include. Each of the prediction programs contains several modules and / or functions to perform different tasks. For example, each prediction program includes a statistical model 919 , 919.2, 919.3, which can be used to solve a particular prediction problem. The statistical model can, in particular, be a predictive model that is produced in the context of a training process on the basis of training data 914 , 914.2, 914.3 has learned to recognize statistical relationships and correlations within the training data and to store the knowledge thus learned in the model so that the model is able to make a reliable prediction on the basis of new input data not contained in the training data set to calculate. The prediction programs 906 , 906.2, 906.3 can thus each contain different functions and in particular machine learning (ML) algorithms that can be used to train the model (also referred to as an ML model) during the training phase.

According to embodiments of the invention, each of the prediction programs also contains a module or a function for the continuous acquisition and storage of data, which are used as training data 914 , 914.2, 914.3 can be used in the course of the training process of the ML models. For example, the recorded data can be rotation rates and vibration data from the various pumps 920 , 922 , 924 act, taking the data from sensors 916 , 916.2, 916.3 of the respective monitoring system can be detected selectively for the pump that is coupled to the monitoring system.

For example, each of the monitoring systems can be specifically assigned to a pump and operatively linked to it. For example, surveillance system can 902 to the pump 920 be coupled and a semi-autonomous system 926 form. Surveillance system 902 can to the pump 922 be coupled and a semi-autonomous system 928 form. Surveillance system 902 can to the pump 924 be coupled and a semi-autonomous system 930 form. In the course of time, the various monitoring systems will therefore collect different training data depending on the number of revolutions and vibration states that the individual pumps adopt in the course of their operation. The difference in the recorded sensor data can be based, for example, on the fact that the pumps are of different ages and / or are used differently. Which of these features are evaluated in the course of the training process and used to train the model depends on the respective model and the prediction task to be solved by it.

For example, the prediction problem can be the problem of predicting when to replace a pump due to fatigue. For example, in addition to the vibration states, which are known to be good indicators or predictors for material fatigue, the training data can also contain revolutions, which may also have a certain predictivity for the expected material fatigue.

Each of the prediction programs can be an already pre-trained, ML-based translation software that is used to use currently measured input data (for example current vibration states and the current number of revolutions of the pump) in order to predict the point in time at which the vibration states will occur Indicate the need to replace the pump. The timing of pump or pump replacements made in the past Pump components for certain vibration states and rotation values are also included in the training data sets. In the course of the training phase, the ML model learns to assign vibration states and / or speed profiles to the point in time at which the pump or pump components were replaced due to material wear. The learned assignments can be stored, for example, in the form of one or more tables 912.1, 912.2, 912.3. These measured values and assignments obtained over time are used as training data 914 , 914.2, 914.3 are each saved locally.

According to embodiments, a new training of its ML model for each of the monitoring systems at regular intervals 919 , 919.2, 919.3 on the meanwhile expanded training data set. This can have the advantage that the quality of the ML model and thus the quality of the predictions generated by it increases, because the more extensive the training data set, the higher the quality of a predictive model trained on it.

According to preferred embodiments, each of the prediction programs contains a module 908 , 908.2, 908.3 for synchronizing the training data and / or the trained model with the other prediction programs. For example, each of the monitoring systems can be registered in the form of a virtual user with a corresponding account in an ID database of the respective other monitoring system. In addition, each of the monitoring systems can store the training data recorded locally by them in the form of one or more data sets in a user data database. Each of these data records can contain one or more access certificates.

User certificates, owner certificates and / or access certificates as well as corresponding chain objects which assign owner rights and / or access rights to individual users (and thus monitoring systems) can be stored in the ID database of the respective monitoring systems. In the course of the synchronization, each of the monitoring systems sends a synchronization request to each of the other monitoring systems, the monitoring system acting as the recipient of this request being configured to carry out a check of the request in accordance with the embodiments of the invention described here. For example, the synchronization request contains at least one access certificate which authorizes read and / or write access to a specific data record of the recipient monitoring system. The access certificate is a simple numeric value, for example "29347293892877172". After receiving the request, the receiver monitoring system first checks in a first test step whether such a value is available in its ID database. Since this step is only a comparison of a numerical number for identity, this step can be carried out very quickly.

If the recipient monitoring system does not know this value, no further check is carried out and the request is not answered. According to embodiments, the receiver monitoring system interrupts the network connection to the transmitter monitoring system at least for a certain time 328 .

Only in the event that a corresponding value is contained in the ID database does the recipient monitoring system carry out further test steps, which in particular include a complex test as to whether the monitoring system from which the request originates has the necessary rights to carry out the requested access action on the data record or the database. For example, in the course of this further check, a complex and computationally expensive certificate chain check can be carried out. For example, in addition to the credentials “29347293892877172”, the request can contain a user certificate that was issued by a certification authority (CA) for the monitoring system sending the request (“transmitter monitoring system”).

The monitoring system that received the request (“receiver monitoring system”) can identify an access authorization chain object within the ID database in the course of further testing, which gives this user certificate the access certificate “29347293892877172” via a chain of several other user certificates assigns, whereby the other user certificates are for users or monitoring systems who have ultimately indirectly assigned the access right “29347293892877172” to the transmitter monitoring system. The user certificates of these users or monitoring systems were issued, for example, by the same certification authority or a subordinate, trustworthy authority. By means of the certificate chain check, the recipient system can reliably check whether the request monitoring system has actually received its access rights from users who are known to the recipient monitoring system and are considered to be trustworthy and who themselves each had this access right. If the further test is positive too, the transmitter monitoring system may synchronize its locally acquired training data and / or its locally trained and improved ML model with the local training data or the model of the receiver monitoring system.

5 Figure 3 shows a block diagram of a monitoring system 100 with several user data databases 102 DB1, 104 DB2 and an ID database 136 . The monitoring system includes an access management system in the form of access management software that is configured to allow multiple users U1, U2, U3, ..., to access multiple data records 112 , 114 , 116 to control. Each of the users U1, U2, U3 represents a monitoring system, for example the present monitoring system 100 as well as external monitoring systems.

For example, a first user U1 is a user certificate 134 assigned. The user certificate 134 was approved by a certification body 140 issued as a root certificate for user U1. User U1 can, for example, use the surveillance system 100 represent, users U2, U3 could each represent external monitoring systems, which may make inquiries to the monitoring system 100 can send in order to read or create user data in the user database or to trigger the execution of a functionality linked to a user data record. User certificates could also be provided to the other monitoring systems in an analogous manner 132 , 124 that were issued as root certificates by the certification authority. The user certificates 134 , 132 , 124 can be checked through a certificate chain check up to the corresponding red certificate from the certification body.

The first user U1 could, for example, use the monitoring system 100 himself or a technical administrator for the user data databases DB1, DB2 of the monitoring system 100 be. Correspondingly, the first user U1 can have an owner certificate 128 be assigned for the first user data database DB1. The assignment, also called “link”, can, for example, be in the form of an authorization chain object 139 implemented and in an ID database 136 be saved.

The access management system is thus designed to issue a first owner certificate, for example owner certificate 128 regarding DB1 or owner certificate 130 to be linked with the first user U1 with respect to DB2. This can be done by storing the owner certificate 128 and the user certificate 134 of the first user U1 in an ownership authorization chain object 139 take place or by saving the owner certificate 130 and the user certificate 134 of the first user U1 in an ownership authorization chain object 141 . An owner certificate is a certificate that is assigned to one or more user data databases and grants every user to whom it is linked the right to create data records in this user data database. For example, the owner certificate grants 128 every user to whom it is assigned (for example by an ownership authorization chain object) the right to create one or more data records in the database DB1.

The surveillance system 100 includes a first interface 142 that it is the first user U1 who receives the owner certificate 128 for the database DB1 is assigned, makes it possible to create a second owner certificate for the user data database DB1 and to link this second owner certificate to a second user U2. This link with the second owner certificate enables the second user, for his part, to create data records in the user data database DB1. If the second owner certificate can be delegated according to its delegation parameter, the second user can also use this first interface in order to issue identical or modified copies of the owner certificate for the database DB1 to other users he trusts and in connection with a user certificate store this additional user in the ID database, for example in the form of additional ownership authorization chain objects 139 , 141 .

The surveillance system 100 includes a second interface 144 that it is the second user U2 who has a data record 106 , 108 in the user data database 102 (after he has already been issued an owner certificate for DB1 by the first or another user), enables at least one access certificate to be created and with the user certificate of a user who is to be granted access to this data record to link. The user to whom access is to be granted can be any other user (eg any other monitoring system) who is registered with the access management system and who has the trust of the second user (data record creator). The access certificates of the second user U2 can be, for example, a write access certificate Z.Zert_U2 [W], a read access certificate Z.Zert_U2 [R] and / or an index access certificate Z.Zert_U2 [S] . An access certificate can therefore specify a type of data record access to the data record created by the second user.

If the first user U1 is now on a data record 106 , 108 that the second user U2 has created wants to access, the access management system checks the access authorization of the first user to a data record created by the second user 106 , 108 . The desired access is only granted to the first user if the access management system determines that the first user U1 has both an owner certificate for the useful data database 102 as well as an access certificate Z.Zert U2 [W] (or [R] or [S]) for access to the data record is assigned.

The individual records 106 , 108 , 110 , 112 , 114 , 116 only contain access certificates that the user who created the data record in question assigns to these data records in the course of creation. For example, the monitoring system 100 During the process of creating a new data record, automatically check in the background which access rights are stored in the ID database for the user who is currently creating a data record. This can be particularly advantageous if each user is assigned a predefined set of access certificates (for example for read, write and index access rights) which should automatically be assigned completely to each newly created data record. This situation is in 5 shown. As an alternative to this, however, it is also possible for each user to be assigned several different access certificates (of the same type of access, e.g. read access) in the ID database and for the user to manually select which of these access certificates via a GUI in the course of creating the data record. Certificates should be assigned to the new data record. This can be advantageous because the user can assign the same set of access certificates in the course of creation for a large number of data records that he has available and that have, for example, similar content or a similar level of confidentiality. However, in the event that the user manages ten different credit cards and stores the confidential credit card numbers in ten different data records, the user also has the option of assigning a different access certificate to each of these data records. This has the advantage that the creator can selectively grant each of these credit card number data records to further users only for a specific credit card number data record, that is to say without automatically giving the other users concerned access rights for the other credit card data records. For the sake of simplicity, most of the embodiments and examples described here refer to the fact that a user is assigned 3 access certificates for read, write and index access rights, which are automatically integrated into this data record when the user creates a data record. However, these examples are to be understood in such a way that, according to alternative embodiments and examples, the user who creates a data record can also manually select a certain subset of predefined access certificates assigned to him and integrate it into the data record created.

In the 5 data sets shown show that, for example, the data sets 106 , 108 , and 112 were created by user U2. The record 110 was created by user U1. The record 116 was created by user U3. The predefined access certificates of the respective creators were integrated into the data records. At least the creators have full access to their data sets, provided they also have an owner certificate for the respective user data database. However, it is quite possible that other users have access to individual data sets. However, this information is not contained in the user data database, but in the form of access authorization chain objects 143 stored in the ID database. For example, from the object 143 It can be seen that an access certificate of the user U1 that specifies a read right was assigned by the creator U1 to the user U2 by the user certificate 132 this user U2 within the property 143 linked to the read access certificate from U1. It is also out of the property 143 it can be seen that the user U2 has transferred (passed on) this reading right to a further user U3 by the user certificate 124 of the user U3 within the property 143 linked to the read access certificate from U1. In the course of each transfer of an access right or, consequently, in the course of each assignment of a further user certificate to a specific access certificate, a new access authorization chain object is created in the ID database by the access management system. The human user is preferably offered an intuitive GUI in order to transfer users access or owner rights and thereby generate further certificates or further links of access and / or access rights in the background. Initialize owner certificates with user certificates. The access authorization chain object 143 thus implies that both user U2 and user U3 (and of course also user U1) have read access to the data records created by user U1, for example data record 110 , to have.

In an analogous manner, specify ownership authorization chain objects 139 , 141 a chain of one or more users who have assigned owner certificates to other users and thereby transferred owner rights. So, for example, goes out of object 139 shows that the user U1 has owner rights with regard to the user data database DB1, since the user certificate 134 of the user U1 in the object 139 the owner certificate 128 to which DB1 is assigned. The object 141 specifies that the user U1 has transferred the owner rights for the database DB2 to a further user U2.

If a user requests access to a specific user data database 102 sends, the access management system checks 100 or a component of the same, for example the database in question 102 whether the user who sent the request has been assigned an owner certificate in the ID database. For example, this step could be an analysis of all of the ownership chain objects that refer to them User data database 102 relate, include. Only if the requesting user has these owner rights will he be able to establish a database connection to the user data database 102 and, if requested, the creation of new data records in this database. However, in order for these users to have read or write access to individual data records or to be able to use an index to find out whether a particular data record exists at all, the corresponding rights must also be assigned to it (as a user certificate) in the ID database. Before each access by a user with ownership rights, the access management system also checks whether the user has the necessary access rights.

According to some embodiments (not shown here) each data record of a specific user data database has one or more additional fields for access certificates that are assigned to other users or functions (that is, not specifically to the user who created the data record). For example, a useful data database can be a database with sensor data that has been recorded by one or more sensors of the monitoring system. In order to increase security, for example, each data record of the sensor measured value database can contain an additional field in which a sensor measured value type certificate is stored. For example, the monitoring system can contain several sensors of different types in order to detect the current state of the monitoring system, which can be a device or a component, for example. The sensors can include, for example, temperature sensors, vibration sensors, humidity sensors, turbine speed sensors, etc. If the user data database is a generic sensor database that includes the measured values of all these sensors, an additional field in which a Sensorytp certificate is stored can be contained in each data record of the sensor measured value database. A large number of such fields can be contained per data record, and the access management system can automatically store the corresponding access certificates in the fields for certain types of user data databases in the course of generating a new data record. For example, when a new sensor measurement data record is generated by a temperature sensor, a temperature sensor certificate is automatically inserted into the corresponding field by the access management system. A user who would like to access such a data record must therefore, in addition to the ownership right with regard to the sensor measured value database and in addition to the access authorization by the creator or a user authorized by them, also prove that he has been assigned a temperature sensor certificate. This can increase security, since certain users can be denied access to certain data in a relatively generic and global manner, which can be assumed to be unnecessary for the user's work. For example, temperature data could be viewed as sensitive as it says something about the environment in which the monitoring system was used, whereas the turbine speed only provides information about the condition of the turbine. Depending on the application scenario, it can therefore be advantageous that certain users or other monitoring systems can only access certain measured values that are considered less sensitive in terms of security, but not others. This means that very finely granular rights management can be provided for IoT applications, the checking of which nevertheless does not place excessive strain on the processors of the monitoring systems used as IoT end nodes.

Preferably, the entirety of the access certificates of a data record is connected to one another by one or more logical operators such as “AND” or “OR”, so that a complex, logically connected expression results which specifies which access certificates are assigned to a user must so that this has access to a data record. The access certificates of a data record preferably contain a mixture of access certificates which are personally assigned to the creator of the data record and which must be assigned personally to other users in order to grant them access, and access certificates issued by the access management system or a human user can be automatically or manually assigned to each data record of a specific user data database when it is created (for example sensor type-specific access certificate or control object-specific access certificate, with a control object being a hardware-based or software-based unit that is controlled by a functionality of the monitoring system). These access certificates are also referred to as "attribute certificates".

Optionally, the individual authorization objects 139 , 141 , 143 with the private signature key 107 of the monitoring system 100 (which can be implemented, for example, as a signature key of the access management system instantiated on it). Additionally or alternatively, authorization tokens that are dynamically created by the ID database for the requesting user in response to an access request from a user (e.g. a request from the request unit) to a user data database can be signed (see description 6th ).

6th illustrates the process of creating authorization tokens for two users U2, U3 according to a further embodiment of the method according to the invention. The user U2 can be, for example, the query unit and the user U3 can be a further monitoring system that may also send a query to the monitoring system 100 can send. The monitoring system U2 and / or U3 can, for example, be designed essentially in the same way as the monitoring system 300 according to 1 receiving the request.

There are a large number of users in the ID database 202 , which can each represent a monitoring system according to embodiments of the invention, for example, each have a user certificate 204 assigned. The user certificates are preferably issued by a certification authority 140 issued and with a private signing key 212 signed by the certification authority. The certification authority also provides a public signature verification key 210 available (for example via corresponding public key directories that can be viewed on the Internet). That means the ID database 136 the validity of a user certificate through a certificate chain check including the public signature verification key 210 the certification body can check. In the ID database, identifiers 216 several user data databases can be stored, which in turn can each be assigned one or more own certificates. However, the ID database preferably does not contain any user data or references to individual data records in user data databases.

When a user U2, for example via a corresponding request to the monitoring system 300 , 100 Access to data records that are stored in the user data database DB1 is requested by the monitoring system 100 an authorization request for this user U2 (who represents, for example, a request unit) is automatically generated and sent to the ID database. This analyzes a lot of empowerment chain objects 137 to determine which owner certificates and access certificates correspond to the user certificate 132 of the user U2 are assigned and dynamically creates an authorization token in response to this authorization request 220 for the user U2. This proof of authorization shows that the user U2 has an owner certificate 128 for the database DB1, i.e. the user is authorized to establish a database connection to DB1. In addition, the authorization token shows that the user U2 is authorized for write access to all data records that the user U1 (for example the monitoring system 100 or 300 represented).

For example, the authorization token can be divided into a proof of connectivity 206 for the user U2 with regard to the creation of a database connection to the DB1 and in a proof of access authorization with regard to a certain type of access and with regard to all data records that were created by a certain user.

The authorization token 220 and / or the respective partial authorization token 206 , 225 can have a signature 237 , 236 included with the private signing key 107 the ID database was generated dynamically in response to the authorization request. Each of the user data databases contains a public signature verification key 105 , the one with the private signing key 107 forms an asymmetric cryptographic key pair. Before the user data database DB1 allows the user U2 to set up a database connection and / or to access individual data records, the validity of the signatures is checked in addition to the presence of the corresponding certificates 237 , 236 checked and the establishment of a connection or data record access is only permitted if the signature is valid.

In an analogous manner, the ID database receives the authorization token in response to an access request from user U3 222 generated and signed, from which it can be seen that user U3 is authorized to establish a connection to the database DB1. It also goes out of the authorization token 226 , 242 shows that the user U3 has read and write access to the data records created by user U2 and is also allowed to carry out an index query to find out whether a certain data record that the user has created exists at all. In addition, user U3 may carry out a corresponding index query for data records that user U1 has created, but not have write or read access.

The fact that the user U2 is only allowed to read and write to the data records of the user U1, but not via index access, is evident from the lack of a corresponding access certificate in a corresponding access authorization chain object. This lack is due to box 228 indicated.

The fact that the user U3 is not allowed to read or write to the data records of the user U1 goes out of the boxes 229 , 230 emerged. If a user is not assigned access rights in the form of corresponding access certificates in the ID database, the dynamically created authorization token also contains 220 , 222 do not have the corresponding rights.

The dynamically generated authorization tokens preferably contain 220 , 222 not the entire chain of user certificates of those users who have assigned corresponding owner certificates or access certificates to other users, but only the owner and access certificates assigned to the requesting user and, optionally, the user certificate of the requesting user. Documentation of the chain of transfer of rights is not relevant for proof of authorization. Because the authorization tokens are free from the user certificates in the transmission chain, the size of the authorization tokens can be reduced, the process accelerated and the data traffic reduced.

7th shows an example for four users 402 , 420 , 422 , 438 , which can each represent a monitoring system according to embodiments of the invention, software, a device, another IoT end node or a natural person, which access certificates and user certificates can be assigned to these users in the ID database. For example, the user is 402 a user certificate 412 assigned. In addition, the user is assigned three access certificates for different types of access to the data records he has created, namely the access certificate 404 for read access (eg numerical value "34734939"), the access certificate 406 for write access (e.g. numerical value "3832927117") and the access certificate 408 for access to one or more indices of a user data database (e.g. numerical value "94659237927655") to find out whether and how many data records this user has in the User data database. The other users are also in the same way 420 , 422 , 438 corresponding user certificates and access certificates are assigned.

7th also illustrates a possible sequence of transferring access rights across a chain of multiple users.

In a first step, the user creates 402 or a sensor of the monitoring system 100 a data record in a user data database DB1 410 . In the course of creation, in addition to the actual user data, such as in 7th automatically in the background also the three access certificates 404 , 406 , and 408, which the creating user 402 are stored in the corresponding fields of the data record.

In the next step, the creator transfers 402 with the help of a GUI or in some other way to another user 420 Read rights to the data record 410 (as well as all other data records that the user 402 with this special read access certificate 404 and which therefore contain this access certificate). This means that the access management system in the ID database gives the user this special read access certificate 404 assigns, for example, in which this certificate 404 with the user certificate 414 of the user 420 linked, for example within the same access authorization chain object.

The creator of the record 410 can also grant access rights to another user. So the user clears 402 for example, to another user in the next step 422 (User certificate 418 ) Read and write rights for all of the user 402 created records that contain the certificates 404 and 406 include, a. The ID database or the authorization chain objects are replaced by a new access authorization chain object for each access certificate 404 , 406 that the user certificate 418 should be assigned, supplements which specify that the user 402 the user 422 the access certificates 404 and 406 assigned. In each of the newly generated access authorization chain objects, a copy of the assigned access certificate (s) can be stored which deviates from the original access certificate at least with regard to the value of a delegation parameter. This means that every user in the chain can control whether another user, to whom he has granted certain rights, can pass them on or not. In the in 6th example shown were given to the user 422 the access rights 404 and 406 assigned in a delegable form. As an alternative to this, it is also possible that only a single access authorization chain object is generated, which contains both access certificates 404 , 406 and the user certificate 418 contains.

The user 418 can therefore pass these rights on to others, which is illustrated in the next step: the user 422 assigns the access rights assigned to it 404 and 406 now also to the user 438 to. This assignment causes a new access authorization chain object to be created in the ID database for each of the access certificates 404 , 406 in each of which the user certificate chain contained in them by adding a further user certificate 436 of the user to whom the rights have been assigned is extended by one element. According to an alternative implementation, only one new access authorization chain object is generated per transfer of rights to another user for two or more access certificates that are linked to the same chain of user certificates. In the example of 7b would the certificates 404 and 406 be stored in the same access authorization chain object that also contains the user certificates 418 and 436 contains.

The chain of user certificates documented in the authorization chain objects documents, according to embodiments of the invention, the transfer of owner or access rights over a sequence of several users. The sequence can consist of a simple stringing together of user certificates, the position of the user certificates within the chain objects representing the time series of the transmissions, for example. Optionally, according to some embodiments, the chain of user certificates within an authorization chain object can be generated in that the ID database uses the private keys assigned to the individual user certificates in such a way that the last user certificate in the chain is the new user added to it -Certificate signed so that a certificate chain check is also possible within the chain of user certificates of the individual authorization chain objects.

8th shows an example of user data 500 that are part of a data set 106 , 108 could be. The user data are specified in the JSon format. However, any other data formats can also be used.

9 two hierarchies generated dynamically and independently of one another by several users or monitoring systems, along which access rights on the one hand and owner rights on the other hand were assigned via a cascade of users.

The in 9A The hierarchy shown is a cascade of access rights to one or more data records created by the monitoring system H. For example, the monitoring system H represents a turbine on which several sensors for the temperature and several sensors for vibration states as well as a sensor for the current number of revolutions of the turbine are contained. Each of these sensors as well as the control circuit board of the turbine itself can be implemented as a monitoring system according to embodiments of the invention, which can exchange data with all other monitoring systems after appropriate proof of authorization. For example, after appropriate proof of write authorization, all sensors can write their measurement data to the user database of the controller board or of the monitoring system H, the sensors here each appearing as a query unit and having to prove on the basis of a method according to embodiments of the invention that they have the necessary write authorizations .

For example, depending on the sensor type, the access right can have a right to write [W] as well as a right to read [R] and index access [S]. The various access rights can be transferred to other monitoring systems, e.g. monitoring system H, using three different access certificates. For the initial authorization check, it is sufficient that at least one of the access certificates is available in the ID database of the monitoring system H as reference authorization. If this is the case, in the course of a further authorization check it can be checked whether further access certificates are present in the request and with regard to which types of access these certificates grant an access right.

For example, in the present case the monitoring system H has created a data record that contains three access certificates for the said three access rights (in the user data database). The monitoring system H assigns these access rights to the monitoring systems B and P via the three access certificates, with the monitoring system P in turn passing on these access rights to the data records created by the monitoring system H to the monitoring system D. Monitoring system D thus obtains its access rights to the data from monitoring system H via the "intermediary system" "P".

In the 9B The hierarchy shown here maps a cascade of owner rights to one or more user data databases DB1, DB2. The technical specialist (maintenance user) responsible for the maintenance of the turbine (monitoring system H) and other turbines (monitoring system A) has, for example, owner certificates for both database DB1 and DB2. He transfers these owner rights in such a way that monitoring system H is assigned an owner certificate for the database DB1 and monitoring system A is assigned an owner certificate for database DB2. Monitoring system H in turn transfers ownership rights for the database DB1 to the monitoring systems B, P and D. Each monitoring system that is assigned an owner certificate for e.g. DB1 is thus authorized to establish a database connection to the corresponding user data database and in this create your own data sets. In the present case, the monitoring system D has received ownership rights for the database DB1 via the monitoring system H from the maintenance user. The transfer of access rights via access certificates as in 9A and the transfer of owner rights via owner certificates as in 9B shown take place along a chain of trust dynamically defined between human users and / or monitoring systems.

10 shows a flowchart of a further embodiment of a method according to the invention, according to which an access control to data records 106 , 108 , 110 , 112 , 114 , 116 several User data databases of an access management system 100 with respect to several other surveillance systems. In a first step 952 of the procedure becomes a first owner certificate 128 , 13), that of a user data database 102 of a first monitoring system 100 , 300 , called “U1” here, is associated with this first monitoring system U1. An owner certificate is a certificate which is assigned to one or more user data databases and which grants every monitoring system to which it is linked the right to create data records in this user data database. The link can for example be done manually by a human user via a GUI of the access management system of a monitoring system 100 which contains the user data database and the ID database, or automatically and implicitly by the access management system of this monitoring system, for example when an external monitoring system creates a new user data database within the monitoring system U1.

In a further step 954 becomes a first interface 142 provided, which enables the first monitoring system U1, a second owner certificate for the user data database 102 to create and to link this with a second monitoring system U2 to enable this to record data in the user data database 102 to put on. The first interface can be implemented, for example, in the form of a GUI which has access to the ID database and the certificates created by the monitoring system and / or the assignment of owner certificates to other users in the form of owner certificates created by a correspondingly authorized user. and store user certificate assignments in the ID database. Instead of a GUI, a machine-to-machine interface and / or configuration software can also be used.

In a further step 956 becomes a second interface 144 provided to the second monitoring system U2, which has a data record 106 , 108 in the user data database 102 has created, enables at least one access certificate Z.Zert_U2 [W], Z.Zert_U2 [R], Z.Zert_U2 [S], which specifies a type of data record access to the data record created by the second monitoring system, to create and with to link the user certificate of a surveillance system that is to be granted access to this data record. The second interface can, for example, also be implemented in the form of a GUI or a part of the GUI mentioned above. The access certificates and / or the assignment of access certificates to other monitoring systems in the form of access and user certificate assignments created by a correspondingly authorized monitoring system are stored in the ID database.

In response to an access request from the first monitoring system, the access management system checks the information in the user data database 102 saved records in step 958 whether the first monitoring system has access authorization to a data record created by the second monitoring system, whether the first monitoring system has been assigned a corresponding access certificate for the data records created by the second monitoring system by the second monitoring system. The user data database grants the first monitoring system access to the data records created by the second monitoring system only if the first monitoring system has both an owner certificate for the user data database in the ID database 102 as well as an access certificate for access to the data record is assigned.

List of reference symbols

100

Surveillance system

102

User data database DB1

104

User data database DB2

105

public signature verification key

106

record

107

private signing key

108

record

110

record

111

signature

112

record

113

signature

114

record

115

signature

116

record

118

Delegate parameters

122

Authorization token

123

Module for certificate chain testing

124

third user certificate

125

log

126

Users

128

Owner certificate for database DB1

132

second user certificate

134

first user certificate

136

ID database

137

Access and Ownership Authorization Chain Objects

138

Certificate chain

139

Ownership authorization chain object

140

Certification Authority

141

Ownership authorization chain object

142

first interface

143

Access authorization chain object

144

second interface

202

Users, e.g. registered surveillance systems

204

User certificates

206

Connectivity authorization token for best. User and DB

208

Signature of a private key from a certification authority

210

public signature verification key of a certification authority

212

private signature key of the certification authority

214

Trust center

216

IDs of user data databases

220

Authorization token for user U2

222

Authorization token for user U3

225

Access authorization token for best. User and record

226

Access authorization token for best. User and record

227

Connectivity authorization token for best. User and DB

228

Lack of [S] access rights for user U2 with regard to data created by user U1

229

Lack of [W] access rights for user U3 with regard to data created by user U1

230

Lack of [R] access rights for user U3 with regard to data created by user U1

232

[W] and [R] Access rights of user U2 to data created by user U1

234

Access rights of user U3 to data created by users U1 and U2

236

Authorization token signature 225

237

Authorization token signature 206

238

Authorization token signature 226

239

Authorization token signature 227

240

Authorization token signature 242

242

Access authorization token for best. User and record

300

Surveillance system

302

Microcontroller

304

Processor (s)

306

random access memory

308

Network interface

310

non-volatile program memory

312

Reference authorization

314

Hardware or software functionality

316

Test program

318

Maintenance users

320

attacker

322

inquiry

324

Proof of eligibility within request

326

network

328

Inquiry unit

330

Hospital building

331

Sensor (s)

332

emergency generator

333

Control unit

334

emergency generator

336

Surveillance system

340

system

342

Control unit

344

Control unit

402

User H

404-408

Access certificates for data created by H.

410

record

412

User certificate for user H

420

User B

424-428

Access certificates for data created by B

414

User certificate for user B

422

User P

430-434

Access certificates for data created by P.

418

User certificate for user P

436

User D

440-444

Access certificates for data created by D.

438

User certificate for user D

500

Payload

702

ID management module

802-818

steps

900

Distributed system made up of several monitoring systems

902

Surveillance system

904

processor

906

Prediction program

908

Model synchronization module

914

Training data (captured by local sensor)

916

sensor

919

Machine learning model

920-924

Surveillance objects

926-930

semi-autonomous systems

952-958

steps

Claims (20)

A monitoring system, the monitoring system being a microcontroller-based or microprocessor-based data processing system (300, 336, 902.1, 902.2, 902.3) which can be operatively coupled to a monitoring object (334, 920, 922, 924), the monitoring system comprising: - at least one processor (304, 904.1, 904.2, 904.3); - a network interface (308); - At least one sensor (331) which is designed to detect a current state of the monitored object; and / or a control unit (333, 344, 432) which is designed to change the state of the monitored object; wherein the monitoring system is designed to: • receiving (804) a request (322) via the network interface from a request unit (328); The processor performing a first test (806) on the request; • If the first test shows that the query is not trustworthy, abort (808) the first test without returning a response of any form to the query unit; • only if the first check shows that the query unit is trustworthy, performing (810) a further check of the query by the processor; • only if the further examination of the request shows that the request unit is sufficiently authorized, enabling the transmission of status data of the monitoring object, which were recorded by the at least one sensor, to the request unit and / or changing the status of the monitoring object by means of the control unit according to the Inquiry. Surveillance system according to Claim 1 , whereby the further test is computationally more complex than the further test. Monitoring system according to one of the preceding claims, - where the first check consists of one or more arithmetic operations on numerical data values, the first check in particular consisting of a check as to whether the request contains proof of authorization in the form of a numerical data value that is identical to one in a non-volatile storage medium ( 310) reference authorization (312) stored in the monitoring unit; and or the further check comprising a certificate chain check, the certificate chain check including a check as to whether a user certificate representing the query unit can be derived from a root user certificate that is considered trustworthy via a chain of further user certificates. Monitoring system according to one of the preceding claims, wherein the monitoring object is selected from a group comprising: - An infrastructure object (330, 332, 334), in particular an infrastructure building, a power generation plant, an electricity plant, a water plant plant, a power plant; - a military installation; - an industrial plant for the production of goods; - a device, - a machine; - a vehicle; - an airplane; - a component of the aforementioned objects; - a combination of two or more of the aforementioned objects. Monitoring system according to one of the preceding claims, wherein the status data recorded by the at least one sensor is selected from a group comprising: -Performance parameters of the monitored object, in particular speed, energy consumption, efficiency, acceleration, size change, temperature, amount of consumables used, amount of goods produced or provided, distance covered, temperature ; Wear parameters that indicate wear of the monitored object or its components, in particular vibration measurement data, optical or conductivity-based rust indicators, amount of goods processed or provided, accumulated operating time, distance covered; - Status indicators which indicate a current status of the monitored object, in particular “inactive”, “ready”, “active”, “defective”, “degree of activity in%”; a combination of two or more of the aforementioned state parameters; and / or wherein the change in state of the monitored object brought about by the control unit is selected from a group comprising. - an activation of the monitoring object; - a deactivation of the surveillance object; - an increase in the performance of the monitored object; - a reduction in the performance of the monitored object. Monitoring system according to one of the preceding claims, wherein the monitoring system is configured, if the first check shows that the request is not trustworthy, to disconnect (812) the network connection to the requesting unit. The surveillance system of any preceding claim, wherein the surveillance system includes a non-volatile storage medium (310), the storage medium including: - A first user data database (102, 104), the user data database containing several data records (106, 108, 110, 112, 114, 116), with at least one of the data records status data of the monitoring object recorded by the at least one sensor have been included and / or wherein at least one of the data records contains configuration data that is read by the control unit when the status of the monitoring object is changed and taken into account when the status change; - An ID database (136), with a large number of user certificates (412, 414, 418, 436, 412, 414) and a large number of access certificates (404, 406, 408, 424, 426, 444) are stored, • where a user certificate is a data value that is uniquely assigned to a user, • where an access certificate (Z.Zert_U2 [W], Z.Zert_U2 [R], Z.Zert_U2 [S]) is a numerical data value that can be assigned to a user by assigning this access certificate to his / her user certificate in the ID database grants a certain type of data record access to data records in the user data database; The further check of the request includes a check as to whether the request contains a user certificate to which one of the access certificates is assigned in the ID database, which the request unit for receiving the status data and / or for causing a change in status of the monitoring object authorized, wherein the monitoring system is configured to enable the transmission of the status data and / or the changing of the status of the monitoring object only if the request contains such a user certificate. Surveillance system according to Claim 7 , wherein the storage medium contains one or more reference credentials (312), wherein the monitoring system is configured to match the reference credentials with the request, wherein each of the reference credentials (312) is one of the access certificates of the ID database, the access certificates each numerical Data values are. Monitoring system according to one of the Claims 7 - 8th , wherein the access certificate is selected from a group comprising: - a read access certificate (Z.Zert_U2 [R]), which enables a user read access to the at least one data record; - A write access certificate (Z.Zert_U2 [W]), which allows a user a modifying access to the at least one data record; - An index access certificate (Z.Zert_U2 [S]), which enables a user to know the existence of the at least one data record in the user data database and read access to metadata of the at least one data record. Monitoring system according to one of the Claims 7 - 9 - the request contains a user certificate, referred to here as the request user certificate, - the data records of the user database each containing the access certificate of the user who created the data record as part of the data record in a separate field of the data record ; - wherein a plurality of access authorization chain objects (143) are stored in the ID database (136), wherein each access authorization chain object contains one of the access certificates and one or more of the user certificates, the order of the user certificates in the access authorization chain object being the sequence of the Users who give this access certificate to another user whose user certificate is in the Access authorization chain object is included, the order of the user certificates in the access authorization chain object indicating the sequence of granting the right specified in the access certificate based on the user represented by the first user certificate in the access authorization chain object; - The further check of the request comprises a check as to whether there is an access authorization chain object in the ID database that contains an access certificate that is identical to the credentials contained in the request, this access authorization chain object this access certificate to the request user certificate assigns it directly or via a chain of one or more further user certificates, this assignment proving the granting of the right specified in the access certificate to the request user represented by the request user certificate; the further check being sufficiently authorized to receive the status data and / or to cause the status of the monitoring object to be changed only if the ID database contains such an access authorization chain object. Monitoring system according to one of the Claims 7 - 10 , wherein the execution of the functionality includes the generation of one or more new data records in the user data database, - the user data database being assigned an owner certificate (128, 130), - the owner certificate in the ID database is assigned to a user certificate of a user (U1); - An owner certificate is a certificate that is assigned to one or more user data databases and grants each user to whom it is assigned the right to create data records in this user data database. - the further check comprising a check as to whether the request contains a user certificate which is assigned to the owner certificate of the user data database in the ID database, the further check only showing if this is the case, that the request unit is authorized to initiate the execution of the functionality. Monitoring system according to one of the Claims 7 - 11 , wherein the data records of the user data database contain, in addition to the user data, only the access certificates that grant the user who created this data record access to this data record. Monitoring system according to one of the previous ones Claims 7 - 12th , wherein the request comprises an access request from a request user (U1) to a data record (108) that a creator user (U2) has created in the user data database, the monitoring system being configured to: - Determine the access Certificates (Z.Zert_U2 [W], Z.Zert_U2 [R], Z.Zert_U2 [S]) of the creator-user, which are stored in the user data database as part of a data record (108) by the user data database ; - Sending the request user certificate, which is assigned to the user of the request unit, and the determined access certificates, to the ID database; - In response to the receipt of the query user certificate and the determined access certificates, the ID database generates a credential (220, 222), the credential specifying whether the query user has passed the one data record (108) at least one of the access authorization chain objects is assigned; - Transmission of the credentials from the ID database to the user data database; - Check, by the user data database, on the basis of the credentials, whether the request user has been assigned the required access rights in the form of access certificates with respect to the one data record (108); - wherein the user data database is configured to grant the request user access to the one data record only to the extent that the request user is granted the access certificates assigned to this in the credentials. Surveillance system according to Claim 13 , wherein the ID database comprises a private signature key (107), wherein the user data database (102, 104) comprises a public signature verification key (105) which is designed to verify the signatures created with the signature key, the monitoring system being configured for - Signing of the credentials by the ID database with the signing key, the credentials being transmitted in signed form to the useful data database; and checking by the user data database by means of the signature verification key whether the signature of the authorization verification is valid, the establishment of the database connection between the query unit and the user data database and the data record access being permitted only if the signature is valid. Distributed system (900) comprising: - Several monitoring systems (902.1, 902.2, 902.3) according to one of the preceding claims, which are each coupled to a different monitoring object; wherein each of the monitoring systems is configured to function as the query unit and to send a query to one of the other monitoring systems; wherein each of the monitoring systems is designed to receive a request from one of the other monitoring systems and to check this in the same way as the request from the requesting unit. The distributed system according to Claim 15 The queries serve to exchange measured values and / or control signals, the measured values being data values that were recorded by the sensors and contain status-related information of the monitoring objects, the control signals being data values that are designed to be received by the control unit of the control signals To cause the monitoring system to control the monitoring object, which is operatively coupled to this monitoring system, in accordance with the control signals. Distributed system (900) according to Claim 15 or 16 - each of the monitoring systems containing a prediction program (906.1, 906.2, 906.3), each of the prediction programs containing a machine learning (ML) model (912.1, 912.2, 912.3) trained to calculate the same type of prediction, the trained models of Prediction programs are different, each of the models including pairs (114-128) of associated inputs and outputs, each of the monitoring systems being configured to: - synchronize (304) the input-output pairs of the models such that each model, after synchronization, has the includes same set of input-output pairs; - entering (306) input data into one of the prediction programs; - Calculating (308) a prediction on the basis of the input data by the one prediction program using the synchronized model of this one prediction program; and use of the prediction by the control unit of that monitoring system which contains the one prediction program in order to automatically change the state of the monitoring object which is operatively coupled to this monitoring system as a function of the prediction; and / or returning the prediction to the query unit. System (340, 926, 928, 930) comprising: - the test object (920, 922, 924); - the monitoring system (300, 336) according to one of the previous ones Claims 1 - 14th . A method for monitoring a surveillance object (334, 332, 920, 922, 924) comprising: - operational coupling (802) of a monitoring system (100, 300, 902.1, 902.2, 902.3) to the monitoring object, the monitoring system being a microcontroller-based or microprocessor-based data processing system which comprises: - at least one processor (304, 904.1, 904.2, 904.3); - a network interface (308); - At least one sensor (331) which is designed to detect a current state of the monitored object when there is an operative coupling to the monitored object; and / or a control unit (333, 344, 432) which is designed to change the state of the monitored object by sending a control command to the monitored object when there is an operational coupling to the monitored object; - Receipt (804) of a request (322) via the network interface from a request unit (328) by the monitoring system; - Carrying out (806) a first check of the request by the monitoring system; - If the first check shows that the request is not trustworthy, the monitoring system aborts (808) the first check without returning a response of any form to the request unit; - only if the first check shows that the query unit is trustworthy, performing (810) a further check of the query by the monitoring system; - only if the further examination of the request shows that the request unit is sufficiently authorized, enabling (816) the transmission of status data of the monitoring object, which was recorded by the at least one sensor, to the request unit by the monitoring system and / or changing the status ( 816) of the monitoring object by means of the control unit in accordance with the request by the monitoring system. Procedure according to Claim 19 , wherein the method is used for a monitoring of the monitoring object (334) that is robust against denial-of-service attacks.

Images